T08 · Insecure Dependencies
Warning
- Location
SKILL.md:12- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Bilibili Downloader
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Bilibili downloader, but it handles live session-cookie authentication with too little safety guidance and uses unpinned package installation.
Install only if you are comfortable using a third-party Bilibili downloader. Treat SESSDATA like a password: do not hardcode it, commit it, paste it into shared terminals, or leave it in tracked config files. Prefer a virtual environment and a pinned or reviewed dependency version before running the scripts.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/download_config.json:7- Finding
Configuration Template Encourages Plaintext Storage of a Session Cookie
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The code chunk specifically implements batch downloading of videos from a Bilibili playlist or series by enumerating playlist items and saving each video as an MP4 locally. The declared description broadly describes a downloader for videos, audio, subtitles, covers, and related preferences, but this chunk does not implement those broader media extraction features. More importantly, the concrete behavior here is playlist/series downloading, which is not explicitly represented in the declared purpose. This is a description-behavior mismatch because the actual code’s primary purpose is narrower and somewhat different from the declared general-purpose Bilibili downloader functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code's primary behavior is narrowly limited to downloading one Bilibili video via bilibili-api, with an optional quality argument. It does not implement the other declared capabilities such as extracting audio, downloading subtitles or danmaku, downloading covers, or managing broader download preferences. This is a description-to-behavior mismatch because the declared purpose substantially overstates the functionality actually present in the provided code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The implemented script is clearly related to the declared Bilibili downloading purpose, but the description overstates what this specific code chunk does. The code supports video download, configurable quality, cover download, subtitle retrieval, and output-directory preferences. However, it does not implement audio-only downloading/extraction and does not download danmaku. Because the declared purpose explicitly includes those capabilities, the description does not accurately represent this code chunk's actual behavior.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs users to export a live Bilibili session cookie (SESSDATA) into an environment variable without warning that it is a sensitive bearer credential. That can lead to credential leakage through shell history, logs, process inspection, screenshots, copied snippets, or downstream tools, enabling account takeover or unauthorized access to premium content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide demonstrates setting a live Bilibili session cookie via shell environment variable and directly in code, but provides no warning about secrets handling, logging exposure, shell history, source control leakage, or safer alternatives. In a downloader skill, users are likely to copy-paste these examples verbatim, which increases the chance of credential disclosure and account misuse if the SESSDATA token is leaked.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language content and headings are fully Chinese, which can amount to a language-policy issue if users are not given an opt-in or alternative locale. No justification is provided that this guide is intended only for a Chinese-language or region-specific audience.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes downloading individual Bilibili videos, audio, subtitles, covers, danmaku, and managing preferences, but does not mention playlist or series-wide bulk downloading. This script specifically enumerates all videos in a playlist and downloads them in sequence, which is broader behavior than the stated description.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code performs network requests to Bilibili and writes downloaded media files to the local filesystem. While the script name and function imply downloading, there is no explicit warning in comments or docstrings that it will contact a remote service and save multiple files to the chosen output directory.
- Content
Static analysis
No suspicious patterns detected.