Security audit

bilibili-video-transcriber

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Bilibili transcription skill, but it handles account cookies and can publish transcript content to Feishu in ways that need careful review before installation.

Install only if you are comfortable giving the skill access to a Bilibili session cookie and, when lark-cli is available, allowing generated transcripts and comments to be sent to Feishu. Prefer an isolated environment, a low-privilege Bilibili account, pinned dependencies, and remove or disable Feishu publishing and redundant cookie backups unless you explicitly need them.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/bili_subtitle.py:109
Finding: Bilibili Session Cookie Can Be Forwarded to API-Controlled Hosts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: cookie_manager.py:25
Finding: Excessive Plaintext Replication and Automatic Restoration of Session Credentials
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:4
Finding: Installer Resolves and Executes Unpinned Third-Party Dependencies
Content: View full analysis
=5.2.0 requests>=2.28.0 pydub>=0.25.1 faster-whisper>=0.10.0 pyyaml>=6.0 tqdm>=4.65.0 colorama>=0.4.6 ``` ```python base_dependencies = [ "bilibili-api>=5.2.0", "requests>=2.28.0", "pydub>=0.25.1", "pyyaml>=6.0", "tqdm>=4.65.0", "colorama>=0.4.6" ] faster_whisper_deps = ["faster-whisper>=0.10.0"] cmd = [sys.executable, "-m", "pip", "install"] + base_dependencies result = subprocess.run( cmd, capture_output=True, text=True, timeout=300 ) ``` ### Technical Analysis Every dependency uses an open-ended minimum-version constraint. Installation therefore resolves whatever newer release is available from the active Python package index at installation time. The project provides no lockfile, exact transitive dependency set, or package hashes. Python packages and their transitive dependencies may execute build backends or installation-related code. If a package, maintainer account, distribution artifact, dependency, or configured package index is compromised, running this installer can execute attacker-controlled code. Open-ended constraints also make the reviewed source materially different from the effective code installed in the future. No evidence shows that the currently named packages are intentionally malicious. This finding concerns the unsafe dependency resolution and integrity model. ### Attack Path 1. The user runs `setup.py` or installs the requirements. 2. Pip contacts the configured package index and resolves the latest versions satisfying each `>=` constraint. 3. A compromised or malicious future package release, transitive dependency, or index response is selected. 4. Pip downloads and installs the unreviewed artifact without checking a project-supplied hash. ...[truncated 695 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: cookie_manager.py:245
Finding: Predictable Shared Temporary Files Permit Symlink Overwrite and Login-Flow Manipulation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (126)

Tainted flow: 'audio_url' from requests.get (line 27, network input) → subprocess.run (code execution)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: The script takes an audio URL directly from a remote API response and hands it to yt-dlp without validating the scheme, host, or media type. Although shell injection is mitigated by argument-list execution, this still allows untrusted network input to drive a powerful downloader/parser, creating SSRF-like behavior, unexpected outbound access, and exposure to parser/protocol handling vulnerabilities in yt-dlp or its dependencies.
Content: Scanner excerpt · download_audio.py (reported line 33)May include surrounding context.
python
# 下载音频 audio_file = os.path.join(output_dir, "raspberry_zero.mp3") print(f"⬇️ 下载音频中...") subprocess.run([ "yt-dlp", "-x", "--audio-format", "mp3", "-o", audio_file,

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented behavior includes persistent cookie storage, redundant backups, login-state validation, QR-login support, and reading sensitive credentials from multiple local paths. For a skill advertised mainly as subtitle processing, this is a material privilege expansion that raises the risk of credential leakage, accidental reuse of stale secrets, and unauthorized access if the host is shared or compromised.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior includes persistent cookie storage, redundant backups, login-state validation, QR-login support, and reading sensitive credentials from multiple local paths. For a skill advertised mainly as subtitle processing, this is a material privilege expansion that raises the risk of credential leakage, accidental reuse of stale secrets, and unauthorized access if the host is shared or compromised.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior includes persistent cookie storage, redundant backups, login-state validation, QR-login support, and reading sensitive credentials from multiple local paths. For a skill advertised mainly as subtitle processing, this is a material privilege expansion that raises the risk of credential leakage, accidental reuse of stale secrets, and unauthorized access if the host is shared or compromised.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior includes persistent cookie storage, redundant backups, login-state validation, QR-login support, and reading sensitive credentials from multiple local paths. For a skill advertised mainly as subtitle processing, this is a material privilege expansion that raises the risk of credential leakage, accidental reuse of stale secrets, and unauthorized access if the host is shared or compromised.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior includes persistent cookie storage, redundant backups, login-state validation, QR-login support, and reading sensitive credentials from multiple local paths. For a skill advertised mainly as subtitle processing, this is a material privilege expansion that raises the risk of credential leakage, accidental reuse of stale secrets, and unauthorized access if the host is shared or compromised.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior includes persistent cookie storage, redundant backups, login-state validation, QR-login support, and reading sensitive credentials from multiple local paths. For a skill advertised mainly as subtitle processing, this is a material privilege expansion that raises the risk of credential leakage, accidental reuse of stale secrets, and unauthorized access if the host is shared or compromised.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior includes persistent cookie storage, redundant backups, login-state validation, QR-login support, and reading sensitive credentials from multiple local paths. For a skill advertised mainly as subtitle processing, this is a material privilege expansion that raises the risk of credential leakage, accidental reuse of stale secrets, and unauthorized access if the host is shared or compromised.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior includes persistent cookie storage, redundant backups, login-state validation, QR-login support, and reading sensitive credentials from multiple local paths. For a skill advertised mainly as subtitle processing, this is a material privilege expansion that raises the risk of credential leakage, accidental reuse of stale secrets, and unauthorized access if the host is shared or compromised.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior includes persistent cookie storage, redundant backups, login-state validation, QR-login support, and reading sensitive credentials from multiple local paths. For a skill advertised mainly as subtitle processing, this is a material privilege expansion that raises the risk of credential leakage, accidental reuse of stale secrets, and unauthorized access if the host is shared or compromised.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior includes persistent cookie storage, redundant backups, login-state validation, QR-login support, and reading sensitive credentials from multiple local paths. For a skill advertised mainly as subtitle processing, this is a material privilege expansion that raises the risk of credential leakage, accidental reuse of stale secrets, and unauthorized access if the host is shared or compromised.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Creating remote Feishu/Lark documents is outside the narrow scope implied by subtitle acquisition and transcription. In context, this materially increases risk because processed content, metadata, and comments may leave the local environment and be stored in an external platform without an obvious need for the core function.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Using a subprocess-driven external CLI to publish documents introduces an unnecessary trust boundary for a transcription skill. Even absent shell injection, it delegates sensitive content handling to an external binary and remote service, making data exposure and execution-surface risks higher than required for the stated purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill transmits a login QR code through Feishu, introducing an external messaging/data-exfiltration path not inherent to local transcription. Login artifacts can enable account takeover or session abuse if forwarded, intercepted, or mishandled, especially because the transmission occurs as part of authentication flow.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This file documents Feishu Wiki document creation, block writing, known knowledge-base IDs, and membership management, none of which are necessary for a Bilibili subtitle transcription skill. The presence of unrelated enterprise content-management capabilities materially expands the skill’s operational scope and could enable unauthorized data staging, document creation, or persistence in external Feishu spaces if the agent is induced to use it.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation includes an API flow for adding members to a Feishu Wiki space using an openid and role assignment, which is especially sensitive because it modifies access control rather than merely reading or writing content. In the context of a Bilibili transcription skill, this is unjustified and could be abused to grant access to knowledge-base content or facilitate lateral movement into collaborative systems.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The entire skill release summary and user notification template are written only in Chinese, with no indication that users may choose another language or that the skill is restricted to a Chinese-language audience. This can violate language/locale policy when a skill implicitly enforces a specific language without opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file says videos longer than 20 minutes will be processed with 'Whisper 在线（强制）' but does not warn users that audio/content may be transmitted over a network or to external services. For a transcription skill, that omission can lead users to unknowingly send private or copyrighted media off-device, creating confidentiality, compliance, and consent risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation promotes QR-code login and states that cookies remain valid for one year, but it provides no warning about credential sensitivity, storage risks, account scope, or session revocation. In a skill that accesses a user’s Bilibili account, this can normalize unsafe handling of long-lived session tokens and increase the chance of account takeover or privacy exposure if cookies are logged, cached, or shared.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README states the skill will output structured Feishu documents, but the metadata only describes subtitle retrieval, transcription, and content analysis. This discrepancy is security-relevant because it obscures that the skill may write data into external collaborative systems, changing user data and broadening trust assumptions beyond what the manifest communicates.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The README advertises cookie redundancy storage, session validity checks, and Feishu QR-code re-login, which expands the skill from subtitle retrieval into authentication/session handling. Even if intended for convenience, handling persistent cookies materially increases risk of credential leakage, session misuse, and unauthorized account actions if the skill is installed or adapted without strong safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Describing cookie storage and re-login workflows without clear warnings about handling authentication material is dangerous because users may not realize the skill stores active session tokens. In an agent ecosystem, undocumented secret handling increases the chance of accidental exposure, unsafe reuse, or overly broad trust in a skill that can act under a user's account.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README claims Feishu document creation and wiki classification features that go beyond the stated subtitle/transcription purpose, creating a scope mismatch between expected and actual capabilities. This matters because a user may grant or invoke broader write access to external systems than the skill description suggests, enabling unintended data exfiltration or modification of workspace content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The README describes creating and overwriting Feishu documents but does not clearly warn that the skill can modify user-controlled external data. Without an upfront warning and confirmation boundary, users may unintentionally authorize destructive or privacy-impacting writes to a workspace or wiki.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The release notes add automatic Feishu/Lark document creation, which expands the skill from local subtitle retrieval/transcription into transmitting generated content to an external collaboration platform. That changes the data-flow and trust boundary, and in the absence of explicit consent and clear scope limitation, users may unknowingly publish transcripts or derived summaries containing sensitive content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.