Security checks for vulnerabilities and agentic risk
Overview
The skill has a clear reposting purpose, but it asks the agent to extract browser login cookies and store them locally using missing unaudited code.
Review before installing. Only run this skill if you are comfortable letting it use your Bilibili browser session to upload under your account. Prefer an isolated browser profile and dedicated Bilibili account, audit or obtain the missing scripts first, avoid sharing logs that contain cookies, protect or delete credentials.json after use, and rotate the session if exposed.
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
Location
SKILL.md:41
Finding
Unpinned and Unreviewable Runtime Dependency Installation
Content
View full analysis
Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
Location
SKILL.md:44
Finding
Broad Browser Cookie Access Delegated to Missing and Unauditable Code
Content
View full analysis
Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
Location
SKILL.md:154
Finding
Instruction Encourages Access to Other Agents and Session Records
Content
View full analysis
If another Agent, such as Codex, Claude Code, or another session, has performed a similar task, inspect its counterexample first. Its successful result can disprove the conclusion that the upstream service is unavailable.
### Technical Analysis
The Skill directs the Agent to consult work performed by other Agents or sessions when diagnosing an upload failure. It does not identify an authorized, task-scoped source for that information or require user consent before accessing it.
Reviewing another session is not necessary for the declared function of downloading a user-provided Instagram item and uploading it to Bilibili. Depending on the host environment, session histories and Agent logs may contain unrelated prompts, personal information, filesystem paths, API responses, authentication data, or confidential project material.
This instruction weakens the least-privilege boundary between the current task and other sessions. Even if the stated purpose is diagnostic comparison, the scope is open-ended and may encourage unauthorized discovery or disclosure of cross-session information.
### Attack Path
1. A Bilibili upload or diagnostic request fails.
2. The Skill instructs the Agent to seek successful examples from another Agent or session.
3. The Agent searches accessible histories, logs, state directories, or memory belonging to other tasks.
4. It reads information unrelated to the current user's request.
5. Sensitive data from the other session is incorporated into diagnostics, commands, or the current response.
6. The information is thereby exposed across task or user boundaries.
### Impact Assessment
Poten
...[truncated 512 chars]
The skill requires extracting Bilibili cookies from local browsers using browser_cookie3 and writing them into credentials.json. Accessing browser session cookies is highly sensitive because those tokens can authenticate as the user and be reused for account actions if exposed, logged, or mishandled.
Content
Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
Category
YARA Match
Confidence
98% confidence
Finding
The YARA match is justified here because the skill contains information-stealer-like behavior: it instructs automatic detection of installed browsers and extraction of cookies from them. Although the apparent goal is account setup for Bilibili uploads rather than overt malware, the technique is the same high-risk credential-harvesting pattern and is dangerous in an agent skill context.
Content
Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
The file structure explicitly includes a setup script that pulls cookies from the local browser and writes them to credentials.json. Even though this supports the upload workflow, it normalizes automated access to local credentials and increases the chance of unauthorized account use or secret leakage through files and logs.
Content
Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
Referencing credentials.json.template is less severe than active harvesting, but the overall pattern centers local credential material in filesystem artifacts. If operators convert templates into real credential files in the working tree, those secrets may be accidentally exposed, copied, or mishandled.
Content
Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
This section explicitly tells the operator to generate a real credentials.json from a logged-in browser session. That is credential acquisition from local browser state, which is dangerous because it grants the skill access to authenticated account sessions outside a least-privilege model.
Content
Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
The instructions pair browser_cookie3 installation with immediate use to pull browser cookies. This is a classic credential-access pattern: the tool reads sensitive browser-stored authentication state that can be abused for account takeover or unauthorized posting if leaked.
Content
Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
The skill directs extraction of a full cookie 'triple' from the same browser session and writes it to credentials.json, then uses it for login verification. This is dangerous because it automates collection and persistence of reusable session secrets that can authenticate as the user to Bilibili APIs.
Content
Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.
The shell snippet reads sessdata directly from credentials.json and sends it in a curl Cookie header. This creates a concrete path for sensitive session material to be exposed in shell history, process listings, logs, or copied troubleshooting output, making account compromise more likely.
Content
Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.
The troubleshooting table instructs refreshing credentials.json by extracting browser cookies after logging into Bilibili. This reinforces unsafe secret-handling practices and encourages repeated access to local browser authentication state, expanding exposure and operational risk.
Content
Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.
This diagnostic path explicitly tells the operator to inspect login state using SESSDATA and discusses empty or mismatched cookie sets. Because it operationalizes direct handling of live session tokens during debugging, it materially increases the risk of disclosure or misuse of reusable credentials.
Content
Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/diagnosis-methodology.md (reported line 75)May include surrounding context.
md
from main import BilibiliAllInOne
async def main():
bilibili = BilibiliAllInOne(credential_file="/path/credentials.json")
pub = bilibili.publisher
# 1) 看预上传（这是上传库真实请求形态）
Credential Access
High
Category
Privilege Escalation
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/diagnosis-methodology.md (reported line 125)May include surrounding context.
md
from main import BilibiliAllInOne
async def main():
bilibili = BilibiliAllInOne(credential_file="/path/credentials.json")
pub = bilibili.publisher
# 1) 看预上传（这是上传库真实请求形态）
Credential Access
High
Category
Privilege Escalation
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/pitfalls.md (reported line 152)May include surrounding context.
md
from main import BilibiliAllInOne
async def main():
bilibili = BilibiliAllInOne(credential_file="/path/credentials.json")
pub = bilibili.publisher
# 1) 看预上传（这是上传库真实请求形态）
Credential Access
High
Category
Privilege Escalation
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/pitfalls.md (reported line 157)May include surrounding context.
md
from main import BilibiliAllInOne
async def main():
bilibili = BilibiliAllInOne(credential_file="/path/credentials.json")
pub = bilibili.publisher
# 1) 看预上传（这是上传库真实请求形态）
Credential Access
High
Category
Privilege Escalation
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/pitfalls.md (reported line 168)May include surrounding context.
md
from main import BilibiliAllInOne
async def main():
bilibili = BilibiliAllInOne(credential_file="/path/credentials.json")
pub = bilibili.publisher
# 1) 看预上传（这是上传库真实请求形态）
Description-Behavior Mismatch
High
Category
Not specified by scanner
Confidence
97% confidence
Finding
The documentation instructs operators to add rejected authors to a runtime blacklist, directly contradicting the skill manifest's claim that it does not do author blacklisting. This kind of hidden policy divergence is dangerous because it changes operational behavior in ways users are explicitly told will not happen, enabling undisclosed content suppression and making the skill's real behavior less auditable.
Content
No source excerpt is available for this finding.
Credential Access
High
Category
Privilege Escalation
Confidence
89% confidence
Finding
The documentation centers on maintaining a local credentials.json containing active Bilibili session material. Storing reusable session credentials in a file is sensitive and increases the risk of account compromise if the file is copied, logged, bundled with the skill, or read by other processes.
Content
Scanner excerpt · references/pitfalls.md (reported line 53)May include surrounding context.
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
Category
YARA Match
Confidence
97% confidence
Finding
The setup flow explicitly uses browser_cookie3 to extract browser cookies for bilibili.com, which is behavior strongly associated with credential harvesting. In this skill context it appears intended for legitimate account automation rather than malware, but it still crosses a sensitive boundary by pulling reusable auth material from the browser into a script-managed file.
Content
Scanner excerpt · references/pitfalls.md (reported line 60)May include surrounding context.
This text explicitly states that browser-derived session secrets are written into bilibili_uploader/credentials.json. Persisting live session cookies to disk creates a durable credential target that can be stolen and reused to impersonate the account.
Content
Scanner excerpt · references/pitfalls.md (reported line 63)May include surrounding context.
The diagnostic command reads and prints portions of credentials.json, including lengths and prefixes of sensitive values. Even partial credential disclosure can leak enough metadata for attackers or appear in logs, transcripts, or terminal history where secrets should not be exposed.
Content
Scanner excerpt · references/pitfalls.md (reported line 135)May include surrounding context.
诊断：
bash
python3 -c "import json; c=json.load(open('/path/credentials.json')); [print(f'{k}: {v[:30]}... (len={len(v)})') for k,v in c.items()]"
# 看 SESSDATA 是不是空字符串（len=0）
Credential Access
High
Category
Privilege Escalation
Confidence
95% confidence
Finding
The documentation instructs extraction of SESSDATA, bili_jct, and buvid3 from the browser and writing them to credentials.json. This is credential harvesting from browser storage for reuse outside the browser session boundary, which materially increases the blast radius of any local compromise or misuse.
Content
Scanner excerpt · references/pitfalls.md (reported line 142)May include surrounding context.
The documented check reads the sessdata field from credentials.json and prints it, which normalizes direct inspection of secret values. Even if the expected value is empty in the template, using the same pattern against a populated file would expose active credentials in terminals, logs, or chat transcripts.
Content
Scanner excerpt · references/pitfalls.md (reported line 154)May include surrounding context.
The remediation directs users to run a setup script that populates credentials.json with real browser-derived cookies and validates them. This operationalizes credential extraction and local persistence of reusable session secrets, which is risky even if intended for legitimate automation.
Content
Scanner excerpt · references/pitfalls.md (reported line 160)May include surrounding context.
This note confirms that setup_cookies.py writes real cookies into the placeholder credentials.json and reuses them for operation. The danger is the same: durable session theft risk if the file is mishandled, copied, or accessible to other software.
Content
Scanner excerpt · references/pitfalls.md (reported line 163)May include surrounding context.
