T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bilibili_pipeline.mjs:34- Finding
Shell Command Injection Through Attacker-Controlled Video URL
- Content
View full analysis
- Remediation
View remediation
Security audit
B站视频转录与总结(yt-dlp版)
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with Bilibili transcription, but a crafted URL could cause unsafe command execution or non-Bilibili network access.
Install only if you are comfortable running local yt-dlp commands and sending audio to SiliconFlow for ASR. Until the URL handling is fixed, avoid using untrusted or user-supplied links, because non-Bilibili URLs or crafted URLs may exceed the skill's intended behavior.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bilibili_pipeline.mjs:34- Finding
Unrestricted URL Processing Enables Server-Side Requests Outside the Declared Bilibili Scope
- Content
View full analysis
{ const proc = spawn( "yt-dlp", [ "-f", "bestaudio[ext=m4a]/bestaudio", "--output", outPath, "--no-playlist", "--user-agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "--add-headers", "Referer:https://www.bilibili.com/", url, ], { stdio: ["ignore", "pipe", "pipe"] } ); ``` ### Technical Analysis The Skill is documented as processing Bilibili video links, BV identifiers, and `b23.tv` short links. However, `normalizeUrl()` accepts any value that the generic `URL` constructor can parse. It does not restrict the protocol, hostname, port, embedded credentials, or resolved destination address. The resulting URL is supplied to `yt-dlp`, which can use generic and site-specific extractors to make network requests. While the argument-array use in `downloadAudio()` avoids shell injection at that location, it does not prevent the subprocess from contacting arbitrary destinations. This behavior exceeds the minimum network privileges required for the declared functionality. In an environment that can reach private services, loopback interfaces, cloud metadata endpoints, or other pri ...[truncated 1804 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. 运行 `scripts/bilibili_pipeline.mjs`。
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises QQbot automatic push of processing results but does not clearly warn users that transcripts or summaries may be automatically transmitted to an external messaging endpoint. Because the skill processes user-supplied video content and may generate full transcripts, silent forwarding increases the risk of unintended disclosure of potentially sensitive content.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js // Fetch official subtitles from B站 API if (result.bvid && info.cid_comments) { const apiUrl = `https://api.bilibili.com/x/player/v2?bvid=${encodeURIComponent(result.bvid)}&cid=${encodeURIComponent(info.cid_comments || info.cid)}`; const subResp = await fetchJson(apiUrl); const subtitleItems = subResp.json?.data?.subtitle?.subtitles ?? []; result.subtitles = subtitleItems.map((item) => ({
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The SiliconFlow endpoint use is a true external-data-transfer issue because the script uploads user-derived media content to a non-Bilibili service. While this appears to be intended functionality rather than malicious exfiltration, the skill context makes it moderately risky because users may not realize their downloaded audio is being transmitted externally for processing.
- Content
js form.append("file", new Blob([buffer], { type: ext }), `audio.${filePath.endsWith(".m4a") ? "m4a" : "mp3"}`); form.append("model", model); const response = await fetch("https://api.siliconflow.cn/v1/audio/transcriptions", { method: "POST", headers: { Authorization: `Bearer ${apiKey}` }, body: form,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The SiliconFlow endpoint use is a true external-data-transfer issue because the script uploads user-derived media content to a non-Bilibili service. While this appears to be intended functionality rather than malicious exfiltration, the skill context makes it moderately risky because users may not realize their downloaded audio is being transmitted externally for processing.
- Content
js form.append("file", new Blob([buffer], { type: ext }), `audio.${filePath.endsWith(".m4a") ? "m4a" : "mp3"}`); form.append("model", model); const response = await fetch("https://api.siliconflow.cn/v1/audio/transcriptions", { method: "POST", headers: { Authorization: `Bearer ${apiKey}` }, body: form,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script uploads downloaded audio to SiliconFlow for transcription, but there is no explicit user-facing disclosure or consent step at the point of transfer. Because audio may contain personal data, private speech, or copyrighted content, silently sending it to a third-party service creates a real privacy and compliance risk rather than a purely cosmetic issue.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - **Windows**: `winget install OpenJS.NodeJS.LTS` or download from https://nodejs.org/ - **macOS**: `brew install node` - **Ubuntu/Debian**: `sudo apt-get install -y nodejs npm` ### yt-dlp
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The natural-language instructions and usage description are entirely Chinese, which can amount to forcing a specific language without user opt-in. No note explains that the skill is intentionally region-specific or offers alternative language support.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Multiple user-facing strings, including duration formatting and the generated markdown summary, are fixed in Chinese. This forces a specific language/locale for output without any opt-in or configuration path, which matches the policy's language-choice concern.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/bilibili_pipeline.mjs:16