Security audit

B站-社媒运营专家 | 青虎AI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Bilibili marketing-analysis helper that uses a disclosed Qinghu API and local exports, with risks users should understand before granting API access.

Install only if you are comfortable using Qinghu's API for Bilibili analysis, providing or exposing a Qinghu API token, and having larger result sets saved as local spreadsheet/export files. Review Qinghu costs and permissions before approving tool calls.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to obtain credentials from environment variables (`QINGHU_TOKEN` / `QHKIT_TOKEN`) even though the skill’s stated purpose is Bilibili analysis, not secret management. This expands the skill’s privilege boundary and enables unintended secret access and exfiltration risk if the endpoint, prompt, or downstream handling is compromised.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill mandates automatic file export and reuse of cached local file paths, which introduces filesystem interaction beyond the core task of social-analysis. Automatic local persistence can leak sensitive data between steps or sessions, and reusing cached paths increases the chance of exposing or mishandling prior outputs.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The skill uses broad mandatory activation language for common B站运营-related requests, which can cause over-triggering and unnecessary invocation of privileged behaviors like API access and exports. While not directly a code-execution flaw, it increases the attack surface by making the skill activate in situations where a narrower tool or no tool would be more appropriate.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill directs default table export without a clear user-facing warning that local files will be created and potentially retained. This weakens transparency and consent around data handling, especially when exported records may contain scraped or user-requested analysis data.

Static analysis

No suspicious patterns detected.