ClawHub
Back to skill

Security audit

bilibili summary skill

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do what it advertises, but it handles live Bilibili login cookies in plaintext and uses them too broadly for a final clean approval.

Install only if you are comfortable giving this skill access to a Bilibili login session. Use it in a private workspace, do not paste cookies into chat, do not commit or share cookie.txt, delete the cookie when finished, and invoke it only when you explicitly want Bilibili subtitle retrieval or analysis.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tainted flow: 'sub_url' from requests.get (line 229, network input) → requests.get (network output)

Medium
Category
Data Flow
Content
continue
                if sub_url.startswith("//"):
                    sub_url = "https:" + sub_url
                body = requests.get(sub_url, headers=headers, timeout=10).json()
                if "body" in body:
                    return body["body"]
    except Exception:
Confidence
88% confidence
Finding
The script takes subtitle_url from remote API data and performs a second request while reusing headers that may include the user's Bilibili Cookie. If a malicious or compromised upstream response supplies an unexpected absolute URL, the script could leak authentication cookies to another host or be used for limited SSRF-style outbound access.

Tainted flow: 'sub_url' from requests.get (line 229, network input) → requests.get (network output)

Medium
Category
Data Flow
Content
if sub_url.startswith("//"):
                    sub_url = "https:" + sub_url
                if sub_url:
                    body = requests.get(sub_url, headers=headers, timeout=10).json()
                    if "body" in body:
                        return body["body"]
    except Exception:
Confidence
88% confidence
Finding
This line fetches a subtitle URL obtained from prior network data and includes the same headers object, potentially containing the user's Cookie. If the remote response is manipulated, credentials may be transmitted to an attacker-controlled endpoint and the process can be coerced into making unintended outbound requests.

Tainted flow: 'sub_url' from requests.get (line 229, network input) → requests.get (network output)

Medium
Category
Data Flow
Content
sub_url = "https:" + sub_url

            print("⬇️  正在下载字幕...")
            body = requests.get(sub_url, headers=headers, timeout=10).json().get("body")

        if not body:
            return None, "❌ 获取字幕失败：返回数据为空"
Confidence
90% confidence
Finding
The script downloads subtitle content from a URL returned by prior remote responses and reuses headers that may include authentication cookies. In the skill context, users are encouraged to log in and store cookies locally, which increases the danger because credential-bearing requests may be sent to an untrusted destination if the subtitle URL is hostile or unexpectedly redirected.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger guidance is overly broad: phrases like mentioning a bilibili link "even casually" can cause the skill to activate in many normal conversations that are not explicit requests to process video content. In an agent environment, this can lead to unexpected tool invocation, unintended network access, and unnecessary handling of user-linked content or local login state (such as cookies), increasing privacy and security risk.

Vague Triggers

High
Confidence
96% confidence
Finding
The trigger guidance is overly broad: it says the skill must activate for nearly any mention of Bilibili links, subtitles, summaries, or even a casual mention of a bilibili URL. This can cause the agent to invoke credential-dependent workflows unexpectedly, leading to unnecessary network access, file writes, or prompting users for sensitive login material in contexts where they did not intend to use this skill.

Missing User Warnings

High
Confidence
98% confidence
Finding
The documentation explicitly tells users to manually extract sensitive `SESSDATA` and `bili_jct` cookies and store them in `cookie.txt`, but does not provide adequate warnings about account takeover risk, token scope, local plaintext storage, or safe handling practices. Because these cookies can authenticate the user to Bilibili, exposing or mishandling them could let another party impersonate the account or access account-linked resources.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script writes active Bilibili authentication material (SESSDATA and bili_jct) to a plaintext local file without an explicit warning about its sensitivity or any protection on file permissions. If another local user, process, backup system, or malware can read that file, the credentials could be reused to access the user's account session and perform authenticated actions.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script loads a raw Cookie from disk and automatically attaches it to outbound requests, but it does not present a clear warning about credential sensitivity, privacy impact, or risks of reuse on secondary URLs. In this skill's workflow, obtaining subtitles may require login, so users are likely to provide real session cookies, making accidental leakage or unsafe storage more consequential.

Static analysis

No suspicious patterns detected.