bilibili-video-transcriber

• Outcome: Review
• Latest audit: Aug 9, 2026 · 9:56 AM UTC
• Version: 3.0.0

Overview

The skill mostly matches a Bilibili transcription tool, but it also persists account cookies and can publish transcript/comment content to Feishu using local credentials without enough containment or opt-in control.

Review this skill carefully before installing. Use it only if you are comfortable with it reading and storing Bilibili session cookies, writing transcript/comment files locally, and potentially creating Feishu/Lark documents through any authenticated lark-cli already present. Prefer running the standalone scripts/bili_subtitle.py path for local subtitle retrieval, avoid --login unless needed, and remove stored cookie files when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (47)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if wiki_space:
                cmd.extend(['--wiki-space', wiki_space])
            
            result = subprocess.run(
                cmd,
                input=md_content.encode('utf-8'),
                capture_output=True,

• Confidence: 81% confidence
• Finding: This command invokes an external CLI and passes transcript content to it, extending trust to whatever lark-cli binary is installed in the environment. Although it is not shell-invoked, it still creates a data-exfiltration and supply-chain boundary because sensitive transcript/comment data is handed to a third-party tool and then uploaded externally.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions while its documented behavior clearly requires network access, shell execution, file read/write, and access to environment-like user state such as local cookie files. This creates a transparency and consent gap: an operator may invoke the skill believing it is narrowly scoped, while it can read persistent credentials, write to /tmp, execute ffmpeg/whisper, and contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The public description says the skill handles subtitle retrieval/transcription, but the body also covers QR login, persistent cookie management and recovery, Feishu signaling, document creation, and comment harvesting. This mismatch is dangerous because it hides materially different data flows and account interactions from users and reviewers, increasing the risk of unexpected credential handling and external sharing of user-derived content.

Description-Behavior Mismatch

Medium

• Confidence: 79% confidence
• Finding: Cookie storage management and QR-code re-login imply handling persistent authentication material, which introduces credential exposure risk if storage, logging, or access controls are weak. Because this capability is presented as a core feature but is not clearly declared in the stated scope, users may not anticipate that the skill stores and refreshes sensitive session tokens.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The release notes describe a new capability to automatically create Feishu/Lark documents, which is outside the stated scope of a Bilibili subtitle/transcription skill. Adding external document creation expands the skill from local/media processing into outbound actions on third-party services, increasing the attack surface for unintended data exfiltration, unauthorized publication of transcripts, or misuse of the user's authenticated Feishu environment.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Using `lark-cli` to create external Feishu/Lark documents gives the skill an outbound side effect unrelated to core transcription. Even if implemented for convenience, invoking an external CLI that publishes content can leak sensitive transcripts or metadata to a remote workspace and may abuse existing local authentication context without the narrow, justified need expected for this skill.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The documented workflow expands into Feishu/Lark document creation and wiki manipulation, which goes beyond simple subtitle extraction. This broadens the external data transmission surface because transcript content, summaries, and metadata may be published into third-party collaboration spaces without that behavior being central in the skill identity.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill includes persistent cookie storage, recovery from backup paths, and QR-based reauthentication flows that are not reflected in the manifest description. Handling long-lived authentication material materially increases risk because compromise of those files or unclear consent around their use can expose the user's Bilibili account and enable unintended authenticated requests.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a transcription/subtitle tool, but it also creates Feishu/Lark documents containing full transcript and comment content. That is a material expansion of scope and transmits potentially sensitive user data to an external service without being central to the advertised purpose.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code loads Bilibili cookies from local files and environment variables, giving the skill access to account credentials beyond simple public transcription. In an agent/skill context, undisclosed credential access increases risk of account misuse and unintentional exposure, especially because the same skill also performs network operations.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The CLI exposes login and cookie-management capabilities that materially expand the skill beyond its stated video transcription purpose. That broader scope increases the chance that users will provide account credentials and persistent session cookies to a tool they may only expect to process subtitles, creating unnecessary credential-handling risk if the tool or its dependencies are compromised.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The cookie check routine retrieves and prints account profile information such as username, email, and phone-binding status, which is unrelated to subtitle extraction and expands data exposure. Even if intended for diagnostics, revealing extra account attributes increases privacy risk and may disclose sensitive information in terminals, logs, or shared environments.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Sending a login QR code through Feishu introduces an additional communication channel into the authentication flow, creating a new trust boundary not implied by the skill’s stated purpose. Authentication artifacts relayed through a third-party messaging platform can be intercepted, misdelivered, retained, or accessed by unintended parties, increasing account-compromise risk.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file implements QR-code login, account-session acquisition, validation, and persistent cookie storage, which is broader than the declared subtitle/transcription purpose. Scope expansion into credential handling increases the attack surface and enables long-lived account access if the skill is reused, modified, or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The Feishu signaling capability is unrelated to the core subtitle/transcription function and creates an additional side channel for operational messaging. Even though it only writes a local signal file here, it is explicitly designed to trigger external delivery by another component, expanding data flow beyond user expectations.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The file embeds Feishu Wiki membership-management instructions, including adding members to wiki spaces, which is unrelated to the declared Bilibili subtitle/transcription purpose. Unrelated capability expansion increases attack surface and could enable unauthorized collaboration or data exposure if the skill later invokes these workflows with available credentials.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: This reference document contains substantial Feishu Wiki creation and document-writing workflows that do not align with the stated Bilibili subtitle/transcription function. Such capability mismatch is dangerous because it can conceal unauthorized data exfiltration or side-effecting document creation behind an apparently benign transcription skill, especially if the agent has access to enterprise APIs or tokens.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The tool is presented as a subtitle/transcription retriever, but it silently degrades to returning an AI-generated summary as a successful result. That can mislead downstream users or agents into treating synthetic content as a transcript, creating integrity and trust problems in workflows that rely on accurate subtitles.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script reads Bilibili cookie material from several files in the user's home directory and automatically attaches it to outbound requests. This exceeds the narrow expectations of a subtitle tool and can expose authenticated session data to network operations without clear consent or disclosure.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The installation test script silently changes permissions on `cli.py` with `chmod 0o755`, modifying local files as a side effect of a diagnostic check. For a subtitle/transcription skill, changing file permissions is broader than necessary and can violate user expectations or organizational controls, especially if run in shared workspaces.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The install test executes the local CLI program as part of validation. In the context of a third-party skill, executing bundled code during installation/testing increases exposure because any harmful behavior in `cli.py` will run immediately, even though this file presents it as a harmless help check.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The release summary promotes QR-code login and states that cookies remain valid for one year, but it does not warn users that these cookies are effectively bearer tokens that can grant account access if exposed. In the context of a tool handling authenticated Bilibili sessions, normalizing long-lived credential storage without privacy and session-security guidance increases the risk of account takeover or unauthorized access.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document states that videos longer than 20 minutes are forcibly processed with online Whisper, but it does not disclose that audio/content may be transmitted over the network to external services or mirrors. For a transcription skill that may process private, copyrighted, or sensitive media, omitting this notice can lead users to unknowingly upload content off-device, creating privacy, compliance, and data-handling risks.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Automatically reading sensitive cookies from environment variables without explicit notice can surprise users and violates least astonishment in a security-sensitive context. In agent environments, environment variables often contain secrets, so implicit harvesting increases the chance of unintended credential use or leakage.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The tool writes transcripts and collected comments to local files without an explicit privacy disclosure, which can persist potentially sensitive or copyrighted content on disk. In shared or managed environments, silent storage increases risk of unintended access by other users or processes.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.