Bilibili Transcript Redirect

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:07 AM UTC
• Version: 3.0.0

Overview

This is a small deprecation notice that directs users to install a replacement skill, with no bundled code or automatic behavior.

Before installing the replacement, confirm that bilibili-auto-transcript is the intended package from a publisher you trust, and prefer a pinned or verified release when available. This skill itself only provides migration instructions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Unpinned External Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-27
Vulnerability Type: Unpinned third-party Skill dependency
Risk Level: Medium

bash

clawhub install bilibili-auto-transcript

Technical Analysis

The deprecated Skill directs users to install an externally maintained replacement using only its mutable package name. The installation command does not specify an audited version, immutable digest, integrity hash, or verified artifact.

The replacement package is not included in this project, so its instructions, scripts, permissions, and transitive dependencies cannot be audited from the available source. If the registry entry or publisher account is compromised, the same command could resolve to modified content after this Skill has been reviewed. This creates a third-party supply-chain trust boundary and matches T08: Insecure Dependencies.

The inspected file does not automatically execute the command; exploitation requires a user or agent to follow the documented migration instruction.

Attack Path

1. An attacker compromises the replacement package, its publisher account, or the package distribution infrastructure.
2. The attacker publishes a malicious release under the existing bilibili-auto-transcript package name.
3. A user follows the unpinned installation instruction in SKILL.md.
4. The package manager resolves and installs the attacker-controlled release.
5. Any malicious Skill instructions or executable components supplied by that release run when installed or invoked, subject to the installer and agent's available permissions.

Impact Assessment

Successful exploitation could allow attacker-controlled Skill content to operate with the permissions granted to the package installer or agent runtime. Depending on the replacement package's installation behavior and runtime capabilities, the scope could include modification of agent behavior, access to data available to the ag ...[truncated 360 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the replacement to a specifically audited version rather than resolving the latest release by package name.
• Require and verify an immutable package digest or cryptographic integrity hash before installation.
• Document the expected publisher identity and use registry signature verification where supported.
• Audit the replacement package, including its Skill instructions, scripts, installation hooks, requested permissions, and transitive dependencies.
• Prefer vendoring the reviewed replacement artifact or linking to immutable source and release records.
• Run installation and initial validation in a sandbox with minimal filesystem, network, credential, and tool permissions.
• Avoid claiming that the old package will be overwritten safely unless the replacement process and affected files have been independently verified.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The visible user-facing description and instructions are entirely in Chinese, including the replacement notice and migration steps. Under the stated policy, forcing a specific language without offering the user a language or locale choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.