B站视频下载与解析

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:54 AM UTC
• Version: 1.0.1

Overview

This Bilibili video helper is purpose-aligned, but its unsafe download command and unverified skill installation need review before use.

Install only if you are comfortable with a skill that downloads Bilibili videos into the workspace and may install another analysis skill. Before use, tighten the command handling: validate BV IDs and Bilibili HTTPS URLs, pass arguments without shell interpolation, add -- before the URL, and require explicit approval or a pinned trusted source for doubao-video-analyze.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:42

Finding

Command Injection Through Unvalidated Video Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42–44
Vulnerability Type: OS command injection
Risk Level: High

Vulnerable Code

bash

yt-dlp -P {YOUR_WORKSPACE_DIR}/bilibili/videos -I 1 -o "{BV_ID}.mp4" {video_url}

Technical Analysis

The skill instructs the agent to interpolate user-influenced values directly into a Bash command. In particular, {video_url} is unquoted and is not subject to any documented URL or hostname validation. If the generated command is executed through a shell, shell metacharacters in this value can introduce additional commands, redirections, pipelines, or substitutions.

Although {BV_ID} appears inside double quotes, double quotes do not suppress command substitution such as $() or backtick expansion. Consequently, an unvalidated BV identifier can also become an injection vector. {YOUR_WORKSPACE_DIR} is unquoted, which can cause argument splitting or shell interpretation if the workspace path contains special characters.

Even if the process is eventually invoked without a shell, an attacker-controlled value beginning with a hyphen could be interpreted by yt-dlp as an option unless the end-of-options marker -- is used. The instruction therefore lacks both shell-level safety and argument-level validation.

Attack Path

1. An attacker supplies a crafted value as a Bilibili video URL or BV identifier.
2. The agent follows the skill instructions and substitutes that value into the documented Bash command.
3. The command is passed to a shell for execution.
4. The shell interprets attacker-provided metacharacters or command substitutions rather than treating the entire value as inert data.
5. The injected command executes with the same operating-system privileges and environment access as the agent process.

Impact Assessment

Successful exploitation permits arbitrary command execution under the agent's account. The attacker could read or modify ...[truncated 368 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct a shell command by concatenating dynamic values. Invoke yt-dlp through a process API that accepts an argument array and disables shell interpretation.
• Validate BV identifiers against a strict allowlist pattern before use, accepting only the exact characters and length required by Bilibili identifiers.
• Parse the supplied URL and require an approved HTTPS hostname, such as www.bilibili.com, rather than relying on string-prefix checks.
• Reject embedded credentials, control characters, unexpected ports, URL schemes other than HTTPS, and ambiguous or malformed hostnames.
• Insert -- before the URL argument to prevent option injection.
• Resolve the output directory internally and pass it as a single process argument rather than interpolating it into shell text.
• Generate the output filename only from a validated identifier or an application-generated value.
• Run the downloader with minimal filesystem permissions and without unnecessary secrets in its environment.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned External Skill Installation From an Unspecified Source

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 27
Vulnerability Type: Untrusted dependency installation
Risk Level: Medium

Vulnerable Code

text

2. Check whether the `doubao-video-analyze` skill exists; if not, try installing it first.

Technical Analysis

The skill directs the agent to install doubao-video-analyze when it is unavailable, but it does not identify a trusted registry, verified publisher, immutable version, commit, checksum, or signature. Installing a dependency solely by a mutable name creates exposure to dependency substitution, typosquatting, registry compromise, account compromise, or malicious updates.

Because an agent skill can contain executable scripts or behavioral instructions, installing and invoking an unverified skill may grant third-party content access to the agent's tools, workspace, environment, and current task context. The reviewed file provides no integrity verification or approval boundary before installation.

Attack Path

1. The required doubao-video-analyze skill is absent from the environment.
2. The agent follows the instruction to locate and install it.
3. Resolution occurs through a default or otherwise unspecified source.
4. An attacker publishes a matching package, compromises the legitimate source, or replaces a mutable release.
5. The agent installs and invokes the attacker-controlled skill while analyzing the downloaded video.
6. Malicious instructions or code execute with the permissions available to the agent runtime.

Impact Assessment

The precise impact depends on the installed skill and runtime permissions. A malicious dependency could read or alter workspace files, access environment variables, invoke available tools, disclose video content or other task data, manipulate analysis results, and potentially execute local commands. The reviewed instruction does not itself establish persistence or privilege escalation, but it ...[truncated 96 chars]

Remediation

View remediation

Remediation Suggestions

• Specify an approved repository or registry and the verified publisher identity.
• Pin the dependency to an immutable version, commit hash, or content digest.
• Verify a cryptographic checksum or signature before installation.
• Do not automatically install missing skills during normal execution; require explicit administrative or user approval.
• Review the dependency's instructions and scripts before enabling it.
• Maintain a trusted allowlist of permitted skills and reject similarly named packages from other sources.
• Execute third-party analysis components in a restricted sandbox with minimal filesystem, network, tool, and environment access.
• Define a safe failure mode that reports the missing dependency without attempting an uncontrolled search or installation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says to invoke the skill whenever analysis of video content or understanding visual information is needed, but it does not clearly constrain activation to Bilibili URLs/BV IDs or provide exclusions. This broad phrasing could trigger the skill for generic video-analysis tasks beyond its intended Bilibili-specific scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description is written as an instruction in Chinese and does not offer any language choice or indicate that the language requirement is optional. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill instructs the agent to create a local directory and download remote content into the workspace without an explicit user-facing warning or confirmation about filesystem modification. In an agent environment, this can cause unexpected local state changes, storage consumption, and persistence of untrusted media files, especially if invoked automatically from a loosely matched request.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.