Security audit

Bilibili Helper

Security checks for vulnerabilities and agentic risk

Overview

This Bilibili content helper is mostly on-purpose, but its shell helper has unsafe input handling that could run local commands or read/write Markdown files outside its draft folder.

Install only if you are comfortable reviewing or fixing the shell helper first. Avoid passing untrusted values to the outline duration argument, avoid using draft names containing path characters, and know that draft text and command topics may be stored locally under the tool's data directory.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: scripts/bilibili.sh:118
Finding: Unconditional Third-Party Promotional Output Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/script.sh:66
Finding: Shell Command Execution Through Unvalidated Arithmetic Input
Content: View full analysis
[时长分钟]}" local dur="${2:-8}" echo " ═══ 视频脚本: $topic (${dur}分钟) ═══" echo "" echo " [0:00-0:15] 开场钩子" echo " → 「三秒定生死」: 冲击画面/问题/数据" echo "" echo " [0:15-0:40] 自我介绍+预告" echo " → 「大家好，今天聊$topic」" echo " → 预告内容要点（制造期待）" echo "" local seg=$(( (dur * 60 - 60) / 3 )) ``` ### Technical Analysis The `dur` variable is populated directly from the second command-line argument and is then evaluated inside Bash arithmetic expansion: ```bash $(( (dur * 60 - 60) / 3 )) ``` Bash arithmetic expansion does not merely parse decimal integer strings. It supports variable references, array subscripts, and nested shell expansions. Variable values used in arithmetic contexts can be recursively interpreted as arithmetic expressions. A crafted duration containing an array subscript with command substitution can therefore cause a shell command to run during evaluation. A representative payload is: ```bash 'x[$(touch /tmp/bilibili-outline-pwned)]' ``` When Bash evaluates `dur`, it interprets the supplied value as an arithmetic expression. Evaluation of the array subscript triggers the embedded command substitution. The arithmetic operation can subsequently fail under strict-shell settings, but the substituted command may already have executed. ### Attack Path 1. An attacker gains control over the duration argument supplied to the `outline` command. This can occur through direct local invocation or through an agent that forwards untrusted user input to the script. 2. The attacker invokes the script with a crafted arithmetic expression: ```bash ./scripts/script.sh outline demo 'x[$(touch /tmp/bilibili-outline-pwned)]' ``` 3 ...[truncated 1155 chars]
Remediation: View remediation
[duration-minutes]}" local dur="${2:-8}" if [[ ! "$dur" =~ ^[0-9]+$ ]]; then printf 'Invalid duration: a decimal integer is required.\n' >&2 return 2 fi if (( 10#$dur < 1 || 10#$dur > 120 )); then printf 'Invalid duration: value must be between 1 and 120 minutes.\n' >&2 return 2 fi local duration_number=$((10#$dur)) local seg=$(( (duration_number * 60 - 60) / 3 )) # Continue processing... } ``` The `10#` prefix forces decimal interpretation and prevents values with leading zeroes from being interpreted as octal. Additional hardening should include: - Treating all values passed to arithmetic expansion as untrusted until validated. - Keeping the permitted duration range narrow and appropriate to the application. - Adding regression tests with shell metacharacters, substitutions, array syntax, negative values, very large integers, and malformed numbers. - Avoiding invocation of the script with arguments derived from untrusted content unless each argument has been validated according to its expected type. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:243
Finding: Draft Name Path Traversal Allows Filesystem Reads and Writes Outside the Draft Directory
Content: View full analysis
"$DATA_DIR/drafts/${2:?}.md"; echo "已保存: $2" ;; list) ls -1 "$DATA_DIR/drafts/"*.md 2>/dev/null | xargs -I{} basename {} .md || echo "(空)" ;; show) [ -f "$DATA_DIR/drafts/${2:?}.md" ] && cat "$DATA_DIR/drafts/$2.md" || echo "找不到" ;; esac } ``` ### Technical Analysis The second argument is used directly as a filename under `$DATA_DIR/drafts`: ```bash "$DATA_DIR/drafts/${2:?}.md" ``` Quoting prevents word splitting and wildcard expansion, but it does not prevent filesystem traversal. A draft name containing `../` components can escape the intended drafts directory after path normalization. For example: ```text ../../../../tmp/exposed ``` is converted into a path resembling: ```text $DATA_DIR/drafts/../../../../tmp/exposed.md ``` The operating system resolves the parent-directory components before opening the file. The `save` operation can therefore truncate and overwrite a writable `.md` file outside the drafts directory, while `show` can disclose a readable `.md` file outside that directory. The `.md` suffix limits straightforward attacks to targets ending in `.md`, but it does not enforce confinement to the expected storage directory. ### Attack Path #### Arbitrary File Read Within Process Permissions 1. The attacker identifies a readable `.md` file and determines a traversal path relative to `$DATA_DIR/drafts`. 2. The attacker invokes: ```bash ./scripts/script.sh draft show '../../../../tmp/private' ``` 3. The script constructs a path ending in `/tmp/private.md`. 4. The `-f` check follows the resolved traversal path. 5. If the target exists and is readable, `cat` prints its contents. #### Arbitrary File Overwrite Within Process Perm ...[truncated 1371 chars]
Remediation: View remediation
&2 return 2 fi if [[ "$name" == "." || "$name" == ".." || "$name" == *".."* ]]; then printf 'Invalid draft name.\n' >&2 return 2 fi } ``` Use the validated name only after the check: ```bash cmd_draft() { local action="${1:-list}" local name case "$action" in save) name="${2:?Draft name required}" _validate_draft_name "$name" || return cat > "$DATA_DIR/drafts/$name.md" printf 'Saved: %s\n' "$name" ;; show) name="${2:?Draft name required}" _validate_draft_name "$name" || return if [[ -f "$DATA_DIR/drafts/$name.md" ]]; then cat -- "$DATA_DIR/drafts/$name.md" else printf 'Draft not found.\n' >&2 return 1 fi ;; esac } ``` For defense in depth: - Canonicalize both the drafts directory and target path and verify that the target remains beneath the canonical drafts directory. - Reject symbolic-link targets or open files using platform facilities that prevent symlink following where possible. - Create data directories with restrictive permissions, such as mode `0700`. - Create new draft files with restrictive permissions, such as mode `0600`. - Add tests for `../`, absolute paths, repeated separators, encoded separators, control characters, and symlink-based escape attempts. ]]>

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python skill emits user-facing titles, descriptions, scripts, help text, and labels exclusively in Chinese, which effectively forces a specific language for all users. The file does not provide any opt-in, language selection mechanism, or justification that the skill is intended only for a Chinese-language or region-specific context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The draft save command writes arbitrary user-supplied content to disk without any user-facing notice, confirmation, or privacy disclosure. This can cause users to persist sensitive text unintentionally, especially if they believe the tool is only generating ephemeral output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The _log function silently appends command names and user-provided arguments to a local history file. Because arguments may contain sensitive topics, personal data, or confidential draft subjects, undisclosed logging creates a privacy risk and may leak information to other local users or backups.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's user-facing strings are predominantly fixed in Chinese, including titles, labels, and guidance text, with no option to select another language or indication that the skill is intentionally limited to a Chinese-speaking audience. This creates a natural-language locale policy concern because the skill effectively forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill's natural-language interface, help text, and output strings are presented only in Chinese, effectively forcing a specific language on users. The file does not indicate that the tool is region-specific or provide any language/locale selection.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The user-facing help and module banner describe commands for idea generation, templates, and analytics, but do not disclose that invoking commands writes a history log and that drafts can be saved to disk. This is not merely omitted implementation detail for a shell helper, because the documentation frames the tool as an assistant while the code adds persistent local storage side effects.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The markdown content is entirely in Chinese and presents usage guidance without indicating that the skill is intentionally limited to Chinese-speaking users or that alternative languages are available. Under the language/locale policy rule, this can be treated as a natural-language policy concern when no opt-in or justification is provided.
Content: No source excerpt is available for this finding.