Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Bilibit
v0.1.4B 站视频下载工具。支持哔哩哔哩视频下载、弹幕下载。用户说"B 站下载"、"哔哩哔哩"、"bilibili"时使用。无需 API Key。纯下载工具，不支持搜索。
⭐ 0· 141·0 current·0 all-time
byRoland Dickens@chenlong1314
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (B 站 视频 + 弹幕 下载) matches required binaries (bbdown, ffmpeg) and the included downloader/wrapper code. CLI, history, and download behaviors align with stated purpose. Minor mismatch: some example text and scripts reference a 'search' command which the product scope and SKILL.md say is not supported — this is a UX/documentation inconsistency, not a security issue.
Instruction Scope
SKILL.md instructs only to run the CLI with a URL and options. Runtime code reads only local environment vars for paths (HOME / USERPROFILE) and writes a local history file (~/.bilibit/history.json). The agent would only execute local downloader binaries (bbdown) and ffmpeg as expected; no code attempts to read unrelated credentials or exfiltrate data.
Install Mechanism
Registry metadata said 'no install spec (instruction-only)', but package.json includes a postinstall script (scripts/install-bbdown.js) that downloads BBDown binaries from GitHub releases into node_modules/.bin. Download host is GitHub releases (well-known) which reduces risk, but this is an executable download written to disk — a moderate install-time action. Also scripts/check-deps tries to use package-manager installs (brew / apt) which may not work on all systems. Recommend auditing the downloaded BBDown binary or installing BBDown via your distro/package manager if you prefer.
Credentials
The skill requires no env vars or credentials. It uses only HOME/USERPROFILE for storage and writes local history; no secrets or unrelated credentials are requested. This is proportionate to a local downloader.
Persistence & Privilege
The skill does persist local state (history file under ~/.bilibit) and may install a BBDown executable into node_modules/.bin during npm install, but it does not request permanent platform-level privileges or modify other skills. always:false and normal autonomous invocation settings are used.
Assessment
This package appears to do what it says: download Bilibili videos via BBDown and optionally save danmaku and a local history. Before installing, consider: (1) The package contains a postinstall script that downloads an executable BBDown release and places it into node_modules/.bin — if you are in a sensitive environment, prefer to install BBDown yourself from the upstream project and/or review the specific release binary. (2) The bbdown wrapper uses shell:true when spawning BBDown; avoid passing untrusted shell-escaped input as arguments. (3) History is stored locally at ~/.bilibit/history.json — if that is sensitive, plan to review/rotate or clear it. (4) There are a few documentation examples referencing a 'search' command that isn't implemented; this is only a UX/documentation inconsistency. If you accept the automatic BBDown download (GitHub releases) and local history persistence, the skill is coherent with its stated purpose.bin/bbdown-wrapper.js:15
Shell command execution detected (child_process).
scripts/check-deps.js:17
Shell command execution detected (child_process).
scripts/install-bbdown.js:19
Shell command execution detected (child_process).
src/downloader/bbdown.js:23
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk9786sqnv7awkzrzktg97g3nqh83f954
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
Binsbbdown, ffmpeg