ClawHub
Back to skill

Security audit

Bilibili Auto Transcript

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for Bilibili transcription, but it combines browser session-cookie use, recurring automation, local transcript persistence, and external AI summarization with insufficient safeguards and disclosure.

Review before installing. Use a dedicated or low-privilege environment, avoid storing broad browser session cookies where the skill can read them, keep .env private and locked down, set SUMMARY_API_URL only to a trusted HTTPS provider, use a restricted API key with spending limits, and be aware that transcripts and summaries are retained locally and may be sent externally when AI summaries are enabled.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/generate_summary.py:36
Finding

Unrestricted Summary API Endpoint Can Expose API Credentials and Transcript Content

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/bilibili_transcript.sh:390
Finding

Executable Shell Loading of the .env Configuration File

Content
View full analysis
/dev/null || true; set +a fi ``` The comments and messages above are translated for the English report. The vulnerable operation in the original source is: ```bash set -a; . "$SCRIPT_DIR/../.env" 2>/dev/null || true; set +a ``` ### Technical Analysis The shell dot command (`.`) does not parse `.env` as a passive key-value configuration file. It executes the file as shell source code in the current process. As a result, the `.env` file can contain command substitutions, function calls, redirections, external commands, or any other shell syntax. Those commands execute with all permissions of the account running the transcription script. This is particularly dangerous because the documentation recommends recurring execution. A malicious `.env` payload would therefore execute repeatedly without requiring further interaction. The Python scripts use `python-dotenv`, so shell execution is unnecessary for the declared configuration-loading requirement. ### Attack Path 1. An attacker, compromised synchronization process, malicious archive, or another local account obtains write access to the project `.env` file. 2. The attacker adds shell code, for example: ```bash OPENAI_API_KEY=dummy attacker_command ``` 3. The user invokes `scripts/bilibili_transcript.sh`, either manually or through the documented recurring transcription job. 4. Because `.env` exists and `OPENA ...[truncated 920 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Unpinned and Unverified Third-Party Python Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (60)

Tainted flow: 'url' from os.environ.get (line 38, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/bilibili_scanner.py (reported line 40)May include surrounding context.

python
while True:
        url = f"{API_BASE}?media_id={FAV_MEDIA_ID}&ps=20&pn={pn}"
        try:
            resp = requests.get(url, headers=headers, timeout=30)
            data = resp.json()
        except requests.exceptions.RequestException as e:
            print(json.dumps({"error": f"网络请求失败 - {e}"}))

Tainted flow: 'api_key' from os.environ.get (line 212, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_summary.py (reported line 46)May include surrounding context.

python
],
        "max_tokens": 1024
    }
    resp = requests.post(
        api_url,
        json=payload,
        headers={

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Using external LLM APIs and network access without explicit declared permissions is a real security transparency issue. Users may not realize transcript contents and metadata can be transmitted off-host, which is especially sensitive for private or copyrighted media content.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Using external LLM APIs and network access without explicit declared permissions is a real security transparency issue. Users may not realize transcript contents and metadata can be transmitted off-host, which is especially sensitive for private or copyrighted media content.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Using external LLM APIs and network access without explicit declared permissions is a real security transparency issue. Users may not realize transcript contents and metadata can be transmitted off-host, which is especially sensitive for private or copyrighted media content.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

Using external LLM APIs and network access without explicit declared permissions is a real security transparency issue. Users may not realize transcript contents and metadata can be transmitted off-host, which is especially sensitive for private or copyrighted media content.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Using external LLM APIs and network access without explicit declared permissions is a real security transparency issue. Users may not realize transcript contents and metadata can be transmitted off-host, which is especially sensitive for private or copyrighted media content.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
93% confidence
Finding

The matched command accesses a local Edge browser profile to export cookies, behavior that closely overlaps with credential-harvesting techniques flagged by infostealer detections. Although the apparent goal is functional access to private/member content rather than overt theft, the mechanism is risky because it teaches extraction of live browser session data from user profiles.

Content

Scanner excerpt · references/bilibili-fav-api.md (reported line 101)May include surrounding context.

um:$CHROMIUM_PATH"
--cookies /tmp/bili_cookies.txt
--skip-download
--print title
"https://www.bilibili.com/video/BV1rPDkB7ESC/"

text
⚠️ `--cookies` 参数读写双用，每次调用覆盖目标文件，不要在同一tick多次调用。

通过 yt-dlp 导出 Windows Edge Cookie：
```bash
WIN_USER=$(ls /mnt/c/Users/ | grep -v "Public\|Default\|All Users" | head -1)
yt-dlp \
  --cookies-from-browser "edge:C:/Users/$WIN_USER/AppData/Local/Microsoft/Edge/User Data" \
  --cookies /tmp/bili_cookies.txt \
  --skip-download \
  --print title \
  "https://www.bilibili.com/video/BV1rPDkB7ESC/"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/batch_transcribe.py (reported line 25)May include surrounding context.

python
try:
    from dotenv import load_dotenv
    SKILL_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    load_dotenv(os.path.join(SKILL_DIR, ".env"))
except Exception:
    pass

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bilibili_scanner.py (reported line 19)May include surrounding context.

python
try:
    from dotenv import load_dotenv
    SKILL_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    load_dotenv(os.path.join(SKILL_DIR, ".env"))
except Exception:
    pass

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bilibili_transcript.sh (reported line 390)May include surrounding context.

sh
try:
    from dotenv import load_dotenv
    SKILL_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    load_dotenv(os.path.join(SKILL_DIR, ".env"))
except Exception:
    pass

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bilibili_transcript.sh (reported line 395)May include surrounding context.

sh
try:
    from dotenv import load_dotenv
    SKILL_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    load_dotenv(os.path.join(SKILL_DIR, ".env"))
except Exception:
    pass

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fill_summaries.py (reported line 21)May include surrounding context.

python
try:
    from dotenv import load_dotenv
    SKILL_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    load_dotenv(os.path.join(SKILL_DIR, ".env"))
except Exception:
    pass

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_summary.py (reported line 22)May include surrounding context.

python
try:
    from dotenv import load_dotenv
    SKILL_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    load_dotenv(os.path.join(SKILL_DIR, ".env"))
except Exception:
    pass

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

cleanup_temp deletes files under CLEANUP_DIR, which is derived from a user-controlled output directory. Although the glob prefixes limit deletion to bilibili_* patterns, a caller can still point OUTPUT_DIR at an unintended location and cause deletion of matching files there on exit, making this a path-abuse issue in an agent setting.

Content

Scanner excerpt · scripts/bilibili_transcript.sh (reported line 26)May include surrounding context.

sh
}

cleanup_temp() {
    rm -f "$CLEANUP_DIR"/bilibili_subtitle*.srt "$CLEANUP_DIR"/bilibili_ai_subtitle*.srt \
          "$CLEANUP_DIR"/bilibili_audio*.mp3 "$CLEANUP_DIR"/bilibili_audio*.m4a \
          "$CLEANUP_DIR"/bilibili_audio*.wav "$CLEANUP_DIR"/bilibili_audio*.txt \
          "$CLEANUP_DIR"/.qwen_transcript.txt

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The script sources ../.env directly into the shell using '. "$SCRIPT_DIR/../.env"', which executes shell syntax from that file rather than merely reading a key/value pair. If the .env file is modified by another local process or attacker, arbitrary shell commands could run in the context of the skill, making this more dangerous than simple credential loading.

Content

Scanner excerpt · scripts/bilibili_transcript.sh (reported line 394)May include surrounding context.

sh
echo ""
    echo "🤖 正在生成AI摘要..."
    # 仅在未设置API key时才从.env加载（尊重已存在的环境变量）
    if [ -z "$OPENAI_API_KEY" ] && [ -f "$SCRIPT_DIR/../.env" ]; then
        set -a; . "$SCRIPT_DIR/../.env" 2>/dev/null || true; set +a
    fi
    if [ -n "$BVID" ]; then

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 61)May include surrounding context.

md
1. DB模式（推荐）：python3 generate_summary.py --bvid BVxxx
  2. 文件模式（兼容）：python3 generate_summary.py <转录文件路径>

支持环境变量（或 .env 文件）：
  OPENAI_API_KEY    — API密钥（不设置则跳过摘要）
  SUMMARY_API_URL   — API地址（默认 OpenAI）
  SUMMARY_API_MODEL — 模型名（默认 gpt-4o-mini）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
1. DB模式（推荐）：python3 generate_summary.py --bvid BVxxx
  2. 文件模式（兼容）：python3 generate_summary.py <转录文件路径>

支持环境变量（或 .env 文件）：
  OPENAI_API_KEY    — API密钥（不设置则跳过摘要）
  SUMMARY_API_URL   — API地址（默认 OpenAI）
  SUMMARY_API_MODEL — 模型名（默认 gpt-4o-mini）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bilibili_scanner.py (reported line 25)May include surrounding context.

python
1. DB模式（推荐）：python3 generate_summary.py --bvid BVxxx
  2. 文件模式（兼容）：python3 generate_summary.py <转录文件路径>

支持环境变量（或 .env 文件）：
  OPENAI_API_KEY    — API密钥（不设置则跳过摘要）
  SUMMARY_API_URL   — API地址（默认 OpenAI）
  SUMMARY_API_MODEL — 模型名（默认 gpt-4o-mini）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bilibili_scanner.py (reported line 65)May include surrounding context.

python
1. DB模式（推荐）：python3 generate_summary.py --bvid BVxxx
  2. 文件模式（兼容）：python3 generate_summary.py <转录文件路径>

支持环境变量（或 .env 文件）：
  OPENAI_API_KEY    — API密钥（不设置则跳过摘要）
  SUMMARY_API_URL   — API地址（默认 OpenAI）
  SUMMARY_API_MODEL — 模型名（默认 gpt-4o-mini）

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_summary.py (reported line 8)May include surrounding context.

python
1. DB模式（推荐）：python3 generate_summary.py --bvid BVxxx
  2. 文件模式（兼容）：python3 generate_summary.py <转录文件路径>

支持环境变量（或 .env 文件）：
  OPENAI_API_KEY    — API密钥（不设置则跳过摘要）
  SUMMARY_API_URL   — API地址（默认 OpenAI）
  SUMMARY_API_MODEL — 模型名（默认 gpt-4o-mini）

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README advertises AI summary generation via OpenAI-compatible APIs without clearly warning that transcript content may be transmitted to third-party services. Because transcripts can contain personal, proprietary, or copyrighted material, this omission creates a real privacy and compliance risk for users who may enable the feature without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README instructs users to log in with Chromium to obtain Bilibili cookies but does not warn that these cookies are active session credentials. Mishandling them can enable account takeover or unauthorized access if copied, logged, or stored insecurely by the skill or user workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README explicitly documents storing transcripts and summaries in a local SQLite database but does not warn that these artifacts may contain sensitive personal, account, or copyrighted content. This creates a real privacy and data-retention risk because users may persist large amounts of extracted content without understanding the security implications or applying filesystem protections.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares installation and runtime behaviors that require shell, filesystem, environment-variable, and network access, but it does not declare an explicit permission/tool scope. This weakens user visibility and policy enforcement, making it easier for a skill to perform sensitive operations without clear consent boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.