ClawHub
Back to skill

Security audit

哔哩哔哩API服务

Security checks across malware telemetry and agentic risk

Overview

This is a Bilibili lookup skill, but it asks for a third-party API key and persists it locally in plaintext with limited user-facing warning.

Install only if you trust Xiaobenyang with your API key and Bilibili-related queries. Prefer setting XBY_APIKEY through your environment instead of letting the skill save it to a local .env file, and remove any saved .env key when you are done.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill exposes capabilities to read environment variables, read/write local files, and make network requests, yet the documentation does not declare permissions or clearly communicate these actions to users. In this context, that matters because the skill explicitly collects an API key, persists it locally, and sends requests to a third-party service, so the undeclared capabilities reduce transparency and informed consent.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill claims to be a Bilibili API service, but the described behavior indicates requests are actually sent to a third-party MCP service and that API keys are locally persisted. This mismatch can mislead users about where their data goes, what system they are trusting, and what side effects occur on disk, which is especially risky when handling secrets.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The documentation contains leftover references to an unrelated gaokao/school-search skill, indicating the skill instructions were copied without being fully reconciled to the actual purpose. Such inconsistency can cause the agent to choose wrong tools or trust incorrect operational guidance, increasing the chance of unintended actions and making security review harder.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The workflow example instructs calling a school-search function that does not belong to the declared toolset, which is an actively misleading instruction in an agent-routing context. Misleading tool guidance can result in invalid tool invocations, unexpected fallback behavior, or confusion during review about what the skill is truly intended to do.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The module persists an API key to a local .env file in plaintext, which increases the risk of accidental disclosure through source control commits, backups, shared workspaces, or permissive filesystem access. For a content/API integration skill, silently storing long-lived credentials on disk is unnecessary and expands the attack surface beyond in-memory use.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to ask the user for an API key and save it via configuration, but it does not clearly warn that the secret will be persisted in `.env` or explain the sensitivity and handling implications. In this context, secret collection combined with local storage and third-party network use creates a meaningful risk of accidental exposure, over-collection, or uninformed user consent.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code writes sensitive credentials to disk without any user-facing warning, confirmation, or indication of storage location. This can lead users or operators to unknowingly leave API keys in plaintext on the filesystem, where they may later be exposed through repository sync, logs, backups, or other local compromise.

Credential Access

High
Category
Privilege Escalation
Content
default_year: int = 2025

    def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
Confidence
79% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
def model_post_init(self, __context):
        # 强制从 .env 文件读取 XBY_APIKEY
        env_path = Path(".env")
        if env_path.exists():
            content = env_path.read_text(encoding="utf-8")
            for line in content.splitlines():
Confidence
79% confidence
Finding
.env"

Credential Access

High
Category
Privilege Escalation
Content
def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()
Confidence
95% confidence
Finding
.env"

Credential Access

High
Category
Privilege Escalation
Content
def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()
Confidence
94% confidence
Finding
.env"

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
94% confidence
Finding
requests>=2.31.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
94% confidence
Finding
pydantic>=2.7.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
94% confidence
Finding
pydantic-settings>=2.2.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1
Confidence
94% confidence
Finding
python-dotenv>=1.0.1

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low
Category
Supply Chain
Confidence
88% confidence
Finding
requests==2.31.0

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
80% confidence
Finding
python-dotenv==1.0.1

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.