Security audit

BiliYouTik2Brain

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its video-processing purpose, but it needs review because it can use browser login cookies, send media or transcripts to cloud services, and its advertised private mode is not actually enforced.

Install only if you are comfortable with the skill downloading videos, reading or using platform cookies from your browser unless disabled, sending transcripts/audio/images to configured cloud model providers, and writing persistent local knowledge files. Do not rely on --private for sensitive content unless the implementation is fixed and tested to block all non-local network paths; disable browser-cookie use and runtime upgrades if you do not explicitly need them.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/biliyoutik2brain/core/anti_crawl_middleware.py:115
Finding: Silent Access to Browser Authentication Cookies
Content: View full analysis
List[Dict]: """Extract cookies from a browser using yt-dlp.""" sys_platform = os.sys.platform if hasattr(os, 'sys') else 'linux' cookie_path = _COOKIE_PATHS.get(browser, {}).get(sys_platform, "") if not cookie_path or not os.path.exists(cookie_path): return [] cookies = [] domains = _COOKIE_DOMAINS.get(platform, []) try: result = subprocess.run( ["yt-dlp", "--cookies-from-browser", browser, "--no-download", "--dump-single-json", "https://www.example.com"], capture_output=True, text=True, timeout=15 ) if result.returncode == 0 and result.stdout: data = json.loads(result.stdout) cookies = data.get("cookies", []) except Exception: pass if domains: cookies = [ c for c in cookies if any(c.get("domain", "").endswith(d.lstrip(".")) for d in domains) ] return cookies def get_cookies_for_platform(platform: str) -> Optional[Dict[str, str]]: """Return platform cookies as a name-to-value mapping.""" cookies = [] for browser in ["edge", "chrome"]: cookies = extract_cookies(browser, platform) if cookies: break if not cookies: return None return { c["name"]: c["value"] for c in cookies if "name" in c and "value" in c } ``` The recovered values are subsequently attached to requests: ```python # 3. Cookie cookies = get_cookies_for_platform(platform) if cookies: cookie_str = "; ".join(f"{k}={v}" for k, v in cookies.items()) req_headers["Cookie"] = cookie_str ``` ### ...[truncated 2407 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/biliyoutik2brain/cli.py:65
Finding: Documented Private Mode Is Not Enforced by the CLI or Processing Pipeline
Content: View full analysis
``` The CLI does not parse that option. It treats the first argument as the URL: ```python def main(): _init_registry() args = sys.argv[1:] if not args: print(__doc__) return if args[0] == "--list-platforms": platforms = PlatformRegistry.list_platforms() print("已注册平台适配器:") for p in platforms: print(f" - {p.value}") return # Other recognized options are handled here. # Default: full processing url = args[0] _process_v3(url) ``` The actual pipeline selects its environment and processing engines without enabling or enforcing private mode: ```python def _process_v3(url: str): """v3.0 confidence-driven pipeline.""" from .core.pipeline import collect from .core.collector import CollectionResult, decide_strategy from .core.env import detect from .core.speaker_knowledge import format_context, format_asr_hints env = detect() print(f"🚀 v3.0管线启动 | {env.profile_summary}") # Collection and transcription follow. ``` A separate privacy module exists, but its compliance function only reports configuration issues: ```python _PRIVATE_MODE = False def is_private_mode() -> bool: """Return whether private mode is enabled.""" global _PRIVATE_MODE return _PRIVATE_MODE or os.environ.get( "BILI_PRIVATE_MODE", "" ).lower() in ("1", "true", "yes") def set_private_mode(enabled: bool): """Set private mode.""" global _PRIVATE_MODE _PRIVATE_MODE ...[truncated 3709 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: install.sh:35
Finding: Unpinned Dependencies and Automatic Runtime Package Upgrades
Content: View full analysis
/dev/null; then echo " 安装 $pkg..." python3 -m pip install --quiet "$pkg" || echo " ❌ $pkg 安装失败" fi done } ``` The installer performs another unpinned installation for `yt-dlp`: ```bash if ! command -v yt-dlp &>/dev/null; then echo " 安装 yt-dlp..." python3 -m pip install --quiet yt-dlp || \ echo " ⚠️ yt-dlp 安装失败，可手动: pip3 install yt-dlp" else echo " ✅ yt-dlp 已安装: $(yt-dlp --version)" fi ``` The anti-crawl self-healing path changes executable dependencies at runtime: ```python def _heal_upgrade_ytdlp() -> Tuple[bool, str]: """Xiaohongshu recovery: upgrade yt-dlp to the latest version.""" try: subprocess.run( ["pip", "install", "--upgrade", "yt-dlp"], capture_output=True, timeout=60, check=False ) r = subprocess.run( ["yt-dlp", "--version"], capture_output=True, text=True, timeout=5 ) version = r.stdout.strip() if version >= "2026.6.9": return True, f"yt-dlp已升级到 {version}" return False, f"yt-dlp升级后版本 {version} 仍 < 2026.6.9" except Exception as e: return False, f"yt-dlp升级失败: {e}" ``` A second automatic update exists in the auto-fixer: ```python subprocess.run( [sys.executable, "-m", "pip", "install ...[truncated 2747 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (461)

Tainted flow: 'headers' from os.environ.get (line 413, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 93% confidence
Finding: The code sends the local audio file to a third-party cloud ASR service and authenticates with an environment-sourced API key, creating an external data exfiltration path. In this skill's context, uploaded audio may contain sensitive spoken content, and the transfer can happen as part of normal processing without any in-function consent or data-classification guardrails.
Content: Scanner excerpt · scripts/biliyoutik2brain/core/asr.py (reported line 418)May include surrounding context.
python
"model": "paraformer-v2", "parameters": json.dumps({"language_hints": ["zh"]}), } resp = requests.post(url, files=files, headers=headers, data=data, timeout=120) if resp.status_code != 200: raise RuntimeError(f"百炼ASR 请求失败: {resp.status_code} {resp.text[:200]}")

Tainted flow: 'req' from os.environ.get (line 37, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: The code reads a credential from the environment and sends it in an Authorization header to a local HTTP endpoint on 127.0.0.1. Although the destination is localhost, this still exposes a secret to any local service bound there and uses cleartext HTTP, so a malicious local process could capture or misuse the key.
Content: Scanner excerpt · scripts/biliyoutik2brain/core/auto_fixer.py (reported line 42)May include surrounding context.
python
headers={"Authorization": f"Bearer {gw_key}"} ) try: urllib.request.urlopen(req, timeout=5) return True except Exception: return False

Tainted flow: 'req' from os.environ.get (line 37, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/biliyoutik2brain/core/auto_fixer.py (reported line 88)May include surrounding context.
python
"Referer": "https://www.bilibili.com/", }) try: resp = urllib.request.urlopen(req, timeout=10) if resp.status == 412: errors.append("B站API 412反爬拦截") except urllib.request.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 37, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/biliyoutik2brain/core/auto_fixer.py (reported line 108)May include surrounding context.
python
req = urllib.request.Request("https://www.douyin.com/", headers={ "User-Agent": "Mozilla/5.0" }) resp = urllib.request.urlopen(req, timeout=10, context=ctx) if resp.status != 200: warnings.append(f"抖音主页HTTP {resp.status}") except Exception as e:

Tainted flow: 'req' from os.environ.get (line 183, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: The health-check request uses a URL derived from VLLM_BASE_URL, which can be set via environment variables, and performs an outbound request without validating scheme, host, or network range. In hostile or multi-tenant environments this can be abused for SSRF-style access to internal services or unexpected network egress during backend auto-detection.
Content: Scanner excerpt · scripts/biliyoutik2brain/core/llm.py (reported line 184)May include surrounding context.
python
import urllib.request url = _BACKEND_CONFIGS["vllm"].base_url.rstrip("/v1") + "/health" req = urllib.request.Request(url) resp = urllib.request.urlopen(req, timeout=3) return resp.status == 200 except Exception: return False

Tainted flow: 'req' from os.environ.get (line 183, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: This code sends prompts and transcription content to a URL fully controlled by backend configuration and environment variables. If an attacker can influence base_url or backend selection, they can redirect sensitive transcript data and authorization headers to an arbitrary endpoint, causing data exfiltration and possible credential leakage.
Content: Scanner excerpt · scripts/biliyoutik2brain/core/llm.py (reported line 230)May include surrounding context.
python
for attempt in range(config.max_retries + 1): try: resp = urllib.request.urlopen(req, timeout=config.timeout) result = json.loads(resp.read().decode("utf-8")) return result except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 183, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: The Ollama request posts user transcript content to a configurable OLLAMA_BASE_URL without validating that it is truly local. If that environment variable points to a remote or attacker-controlled server, supposedly local processing becomes external transmission of potentially sensitive content.
Content: Scanner excerpt · scripts/biliyoutik2brain/core/llm.py (reported line 279)May include surrounding context.
python
for attempt in range(config.max_retries + 1): try: resp = urllib.request.urlopen(req, timeout=config.timeout) return json.loads(resp.read().decode("utf-8")) except Exception as e: if attempt < config.max_retries:

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents the skill as a complete operational engine for processing video links into structured knowledge. However, the provided code chunk is purely an installer/bootstrap script. While some installed dependencies are consistent with the declared system (yt-dlp, faster-whisper, ffmpeg, storage directories, LLM API key hints), the code itself does not carry out the described end-to-end workflow. This is a material description-behavior mismatch for the supplied chunk because the actual behavior is setup/deployment rather than video ingestion and analysis. The install functionality is a supporting part of such a system, but on its own it does not match the declared primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a full video-processing knowledge engine activated by video URLs and carrying out download, transcription, LLM enhancement, analysis, and saving. The provided code does none of those primary tasks. Instead, it is a standalone preflight script for environment validation before installation. While some checked dependencies (ffmpeg, yt-dlp, faster-whisper, API keys, proxies) are supportive of the declared system, this code chunk’s actual purpose is materially different from the declared skill behavior. Therefore this chunk does not accurately represent the described functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full end-to-end video knowledge extraction system. The supplied code chunk, however, is only an init.py for a common utilities package that exposes markdown-to-HTML/JSON conversion helpers. That behavior is materially narrower and different from the declared primary purpose. While utility formatting could be a supporting detail inside a larger system, this specific chunk does not implement or evidence the core declared capabilities, triggers, or workflow. Therefore this code chunk does not accurately represent the declared functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full end-to-end video ingestion and knowledge-engine workflow. The supplied code only implements formatting and structured extraction from already-existing Markdown text. Its docstring explicitly states 'pure rule format conversion' with no external dependencies and no LLM calls. The functions operate on Markdown strings, channel formatting capabilities, HTML conversion, plain-text downgrade, and JSON extraction from Markdown sections. This is materially narrower and different from the declared primary purpose, so the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about ingesting video links, transcribing content, structuring knowledge, OCR, analysis, and saving outputs. The supplied code does none of that directly. Instead, it performs host-level activity sensing using OS commands such as tasklist, ps, and sysctl or /proc/loadavg, then returns scheduling/throttling recommendations. While such monitoring could be a supporting optimization for a background processing pipeline, this chunk introduces materially different capabilities—local system activity inspection and adaptive task scheduling—that are not represented in the declared purpose. Therefore this code chunk is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The declared description presents a full video-to-knowledge engine focused on fetching video links, transcribing content, structuring knowledge, OCR, output formatting, and saving results. The supplied code chunk does not implement those user-facing pipeline functions. Instead, it provides infrastructure logic: resource admission decisions, queue-length/degradation handling, FFmpeg crash recovery, and metrics logging. Some of this can be considered supporting infrastructure for such a system, but this chunk also adds undeclared capabilities with security relevance, notably executing apt-get and pip3 to reinstall software, reading/writing local state files, and managing proxy/resource constraints. Because the actual code’s primary purpose is operational control and self-healing rather than the declared end-user video processing behavior, this is a meaningful description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a user-facing end-to-end video ingestion, transcription, analysis, and knowledge archival engine. The supplied code chunk is not that pipeline; it is a lower-level operational defense/self-healing module. Some of this can be considered supportive of the declared system—e.g., anti-crawl handling, ASR robustness, and LLM retry logic are plausibly implementation details for a video-processing engine. However, the code also performs materially undeclared system-management capabilities, including invoking pip to upgrade yt-dlp, launching a local proxy startup script, and deleting temporary files across filesystem locations. Those are significant behavioral capabilities not conveyed by the description. So while related to the broader product, this specific code chunk's actual purpose is infrastructure resilience and environment manipulation rather than the declared primary function of collecting/transcribing/analyzing/archiving video content, making this a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broad end-to-end video knowledge engine. The supplied code chunk is much narrower: it is an ASR module operating on an audio_path input and handling transcription plus confidence-related postprocessing. While transcription is one sub-step consistent with the larger product description, the code’s actual behavior does not match the declared trigger model or most of the claimed capabilities. It neither detects nor processes video links, performs downloading/scraping, OCR, structured knowledge analysis, persistence, or export workflows. Because the declared purpose emphasizes a single-command video→knowledge pipeline, but this code only provides the ASR layer for local audio, this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents an end-to-end video ingestion and structured knowledge engine with platform link triggers, collection, transcription, LLM repair, analysis, and storage/export features. The supplied code does not implement that workflow. Instead, it is a narrow internal component for audio assessment: extracting short WAV samples, detecting silence/speech regions, testing transcription quality on samples, and selecting a transcription model. While this could support the broader system as an implementation detail, the chunk itself materially differs from the declared purpose and lacks the advertised trigger handling and major capabilities. Therefore this code chunk does not accurately represent the declared behavior on its own.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The declared description presents the skill as an end-to-end video ingestion, transcription, structured analysis, and knowledge archiving engine. However, this specific code chunk is not implementing that core pipeline. Instead, it is an auxiliary maintenance/validation module focused on auto-fixing environment issues and running preflight/quality checks. Some parts are supportive to the declared system (anti-crawl checks, platform-specific validation, output quality checks), so they are not inherently inconsistent. But the chunk also includes undeclared operational capabilities: invoking pip to upgrade software, checking/modifying runtime environment assumptions, and contacting a local gateway API with an auth token. Those are materially different from the user-facing declared purpose and represent system-management behavior not described in the skill summary. Therefore, the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description presents the skill as a production pipeline for taking video links and turning them into structured knowledge artifacts in one command. However, this code does not fetch/process arbitrary user video links into notes/cards/archives, nor does it perform LLM repair, structured analysis, knowledge saving, plugin deployment, anti-crawling, or output generation. Instead, it is a support module focused on internal benchmarking, cost/performance tracking, quality gating before release, and feedback persistence/summary. Feedback-loop support is consistent with the description, and use of transcription/OCR hooks is related, but the dominant behavior of this chunk is materially different from the declared primary purpose, so this chunk should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description presents a full video ingestion and knowledge-extraction engine with specific trigger rules and a one-command pipeline from fetching through transcription, analysis, and saving. The supplied code does not implement that pipeline; instead it provides auxiliary CLI UX and scheduler management. Some parts are loosely supportive of the broader product (platform quick commands, output format selection), but this chunk’s actual behavior is materially different from the declared primary purpose. It also introduces capabilities not mentioned in the description, especially persistent scheduling and miscellaneous system commands. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The declared description presents a full end-to-end video knowledge engine with ingestion from multiple video platforms, transcription, LLM-based repair, structured analysis, saving/archiving, OCR, and various output/export capabilities. The supplied code chunk is much narrower: it is a collector/preprocessing module focused on media handling and timeline normalization. It does not show any link-trigger logic, platform-specific fetching, structured knowledge extraction, archival, OCR, output rendering, plugin/deployment behavior, or anti-crawling mechanisms. While this chunk is consistent with a supporting part of a larger video transcription pipeline, it does not by itself accurately represent the broad declared functionality. Therefore the description overstates what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broad video-processing pipeline centered on ingesting video links and producing structured knowledge artifacts from video/audio content. The supplied code does not implement that workflow. Instead, it focuses specifically on analyzing already-collected comment data: regex-based spam detection, thread extraction, uploader-comment identification, LLM-based topic/sentiment/needs analysis for comments, ranking top comments, and generating a markdown report. While comment analysis could be a supporting feature in a larger video knowledge system, this chunk’s primary purpose is materially different from the declared end-to-end video transcription and archival engine, and key declared capabilities (URL-triggered collection, transcription, OCR, archiving, multi-format outputs) are absent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description centers on an end-to-end video knowledge extraction pipeline triggered by video links and involving video collection, transcription, OCR, LLM repair, structured analysis, and saving/export. The supplied code chunk does something materially different: it analyzes comment text associated with videos, detects duplicate comments, filters low-quality or prohibited content, scores comments for quality, identifies uploader discussion threads, and constructs prompts/reports for summarizing valuable comments. While comment analysis could conceivably be a supporting subcomponent of a broader video-analysis system, the declared purpose does not mention comment filtering/moderation or comment-thread extraction at all, and the code chunk lacks any implementation of the core declared video/transcription/OCR/archive workflow. Therefore this chunk's actual behavior is not accurately represented by the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a high-level video ingestion and knowledge extraction pipeline for online video links. The supplied code does not implement any video URL handling, downloading, transcription, OCR, LLM analysis, archival, plugin integration, or output formatting. Instead, it is a generic support module for platform compatibility and system utilities. While such helpers could be used by a larger video-processing system, this specific code chunk’s actual purpose is materially different from the declared end-user functionality, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description presents a broad end-to-end video knowledge ingestion product centered on accepting social video URLs, collecting content, transcribing it, analyzing it, and saving/exporting it in multiple formats across multiple platforms. The supplied code does not implement that full scope. Instead, it focuses on a narrower internal stage: taking ASR output (or an audio file via a helper), identifying low-confidence transcription regions, selectively sending only those chunks to an LLM for correction, then performing structured analysis. OCR support is present only as supplemental text injected into prompts, which partially aligns with the description's OCR mention, but there is no code for extracting OCR from video frames here. Likewise, there is no link handling, downloader/crawler logic, platform plugin support, persistence/export, or deployment functionality in this chunk. The code also performs optional self-evolution run logging, which is not declared. Therefore, the declared description materially overstates and misrepresents what this specific code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broad end-to-end video ingestion and knowledge extraction system. However, this code chunk implements only a small supporting component: a deterministic correction dictionary and related bookkeeping for transcript corrections. It does not accept or validate video links, fetch content from platforms, transcribe audio, invoke any LLM, analyze content, archive knowledge, generate markdown/cards/notes, perform OCR, or implement deployment/plugins/anti-crawling. The only concrete behavior beyond text replacement is reading/writing local JSON files for correction patterns and stats. Because the actual code’s primary purpose is much narrower and materially different from the declared end-to-end engine, this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.insecure_tls_verification

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/biliyoutik2brain/core/assessor.py:56

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/biliyoutik2brain/core/plugin_loader.py:72

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/biliyoutik2brain/core/anti_crawl_middleware.py:38