bilibili summary skill
v1.0.0处理 B 站（哔哩哔哩）视频字幕的完整工作流。能力包括：（1）引导用户扫码登录获取 Cookie；（2）自动获取视频字幕（优先 AI 字幕，自动回退 CC 字幕）；（3）生成视频内容摘要；（4）当用户询问"某内容在哪个时间段"时，从字幕文件中精准定位时间戳。当用户提供 B 站视频链接、BVID，或提到"b站字幕"...
⭐ 0· 117·0 current·0 all-time
byMark@baikemark
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description match the included scripts: fetch_subtitle.py (calls bilibili APIs), cookie_login.py (QR login to obtain SESSDATA/bili_jct), and search_timestamp.py (local SRT parsing). No unrelated services, credentials, or binaries are requested.
Instruction Scope
SKILL.md directs the agent to read/write local files (cookie.txt, subtitles_output/<BVID>/...), run the included Python scripts, and to prompt or instruct the user to extract cookies if needed. This is expected for subtitle retrieval, but the SKILL.md also instructs aggressive automatic triggering ('even if user casually mentions a bilibili link'), which is a scope/behavior choice worth reviewing (it increases how often the skill runs).
Install Mechanism
No install spec or remote downloads. The skill is instruction- and script-based and depends only on common Python libraries (requests, optional qrcode). No suspicious URLs or archive extraction steps are present.
Credentials
No environment variables or external credentials are requested. The skill requires the user's Bilibili cookies (SESSDATA and bili_jct) to fetch AI subtitles; this is proportionate to the stated capability but those values are sensitive — the skill reads/writes cookie.txt in the working directory. The README asserts cookies are kept local; the code shows no external exfiltration endpoints.
Persistence & Privilege
always:false and no modifications to other skills or global agent configuration. The skill creates/reads files in the user's working directory only (cookie.txt, subtitles_output/), which is normal for this use case.
Assessment
This skill appears to do what it says: fetch Bilibili subtitles (including logged-in AI subtitles), help you log in via QR, and search/generate summaries locally. Before installing or running it: 1) Understand that it needs your Bilibili cookies (SESSDATA and bili_jct) and will save them to cookie.txt in the current directory — treat that file as sensitive. 2) Only run the QR-login flow or paste cookies on a machine you trust; if you share that file or store it in cloud-synced folders it could be abused. 3) Consider disabling the aggressive automatic trigger behavior described in SKILL.md (only invoke the skill when you explicitly request subtitle operations) if you want to limit accidental runs. 4) If you have concerns, inspect the three scripts yourself (they call only official bilibili endpoints) or run them in an isolated environment. Finally, avoid pasting cookies into untrusted UIs and delete cookie.txt when no longer needed.Like a lobster shell, security has layers — review code before you run it.
latestvk97cgnaqnjzjq5egkbkdatrg5583fnxb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.