Bilibili Insight

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 1.0.0

Overview

This Bilibili analytics skill is coherent and low risk, though users should treat its demographic profiling outputs as aggregate estimates and note its unpinned dependency install.

Install only if you are comfortable with a skill that may analyze public Bilibili creator and audience metrics. Use demographic outputs as aggregated estimates, avoid identifying or targeting individual fans, and consider isolating or pinning the Python dependency during installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:14

Finding

Unpinned Python Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–19
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Low

Vulnerable Code

yaml

"requires": { "bins": ["python3", "curl"] },
"install":
  [
    {
      "id": "requests",
      "kind": "pip",
      "package": "requests",

Technical Analysis

The skill declares installation of the Python requests package without specifying an exact version, cryptographic hash, or trusted package index. Consequently, the installed artifact depends on mutable package-index state, dependency resolution at installation time, and the user's local pip configuration.

The declared package is a legitimate and widely used dependency, and the repository contains no evidence that it intentionally references a malicious package. Nevertheless, an unpinned installation creates supply-chain exposure. If the configured package source, a future release, or a transitive dependency is compromised, installation or subsequent import could execute attacker-controlled Python code.

The repository contains no lock file or implementation from which the resolved dependency versions can be audited.

Attack Path

1. A user or automated agent installs the skill and processes its declared pip dependency.
2. Pip resolves requests and its transitive dependencies using the package indexes and configuration active in the environment.
3. An attacker must first compromise a resolved package release, a configured package index or mirror, or dependency-resolution infrastructure.
4. Pip downloads and installs the attacker-controlled distribution because no reviewed version or artifact hash is enforced.
5. Malicious build behavior may execute during installation, or malicious package code may execute when the dependency is imported.
6. The payload runs with the permissions of the process performing installation or using the package.

Impact Assessment

Success ...[truncated 577 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin requests to an exact, reviewed version rather than allowing unrestricted resolution.
2. Maintain dependencies in a lock or requirements file containing cryptographic hashes, for example by generating a hash-locked requirements file with pip-compile.
3. Install with hash enforcement:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Explicitly use an approved HTTPS package index and disable unexpected supplemental indexes where operationally feasible.
5. Pin and hash all transitive dependencies, not only the direct requests dependency.
6. Periodically review pinned versions for security advisories and update them through a controlled testing and approval process.
7. Perform dependency installation in an isolated virtual environment or restricted container under a non-privileged account.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly offers fan profiling with age, gender, region, and interest breakdowns, but only includes a vague statement that data comes from public information. Audience demographic profiling can enable privacy-invasive targeting, inference of sensitive traits, and misuse in marketing or harassment workflows when data provenance, aggregation level, consent, and permitted use are not clearly constrained.

Content

No source excerpt is available for this finding.