Security audit

Bilibili Subtitle Downloader

Security checks for vulnerabilities and agentic risk

Overview

The skill matches a Bilibili subtitle-download purpose, but it asks users to log in and stores reusable session cookies in plaintext with incomplete disclosure and weak controls.

Review before installing. Use this only if you are comfortable authenticating a Bilibili account through the skill. Run it in a private, non-shared workspace, treat the generated cookie/session files as secrets, delete ~/.openclaw/workspace/bilibili_cookie.txt and any bilibili_cheese_session.json when finished, and avoid using it from synced or source-controlled directories until credential storage and URL validation are improved.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/download_and_chunk.py:9
Finding: Reusable Bilibili session cookies stored in a plaintext workspace file
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cheese_downloader.py:79
Finding: Cheese workflow stores authenticated session material in the current directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/download_and_chunk.py:87
Finding: Unvalidated subtitle URL enables conditional SSRF and unbounded network retrieval
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cheese_downloader.py:149
Finding: Cheese subtitle downloader follows an unvalidated API-provided URL
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The English description similarly overstates safe, simple subtitle processing while omitting authentication, cookie persistence, and input limitations. Such description-behavior mismatch is dangerous because it obscures sensitive operations and can lead users to scan a login QR code or expose account-linked data under the mistaken belief that the skill only processes a public video URL.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The English description similarly overstates safe, simple subtitle processing while omitting authentication, cookie persistence, and input limitations. Such description-behavior mismatch is dangerous because it obscures sensitive operations and can lead users to scan a login QR code or expose account-linked data under the mistaken belief that the skill only processes a public video URL.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes local Python scripts that read and write files, access the network, and persist authentication material, yet the manifest does not declare any explicit tool scope or permissions. This weakens reviewability and containment because operators and automated policy systems cannot easily tell that the skill needs network access and local storage of sensitive session data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The QR-code login step asks the user to authenticate the tool to their Bilibili account but does not explain that this grants the tool access to account-linked data and potentially paid or private content available through that session. In this skill context, that omission is more dangerous because the login is embedded inside a subtitle-downloading workflow that appears routine and low-risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs that Bilibili cookies will be saved to ~/.openclaw/workspace/bilibili_cookie.txt but provides no warning that these cookies are authenticated session credentials. Storing them in a predictable local path without security guidance increases the risk of session theft, reuse by other tools, or accidental inclusion in logs, backups, or shared workspaces.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script persists authenticated Bilibili session cookies to a JSON file on disk without warning, permission hardening, or lifecycle controls. Anyone with access to the working directory or logs/artifacts from the agent environment may be able to reuse those cookies to access the user’s account session.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest says users provide a Bilibili BV number or URL to obtain video summaries, but this implementation only handles 'ep...' episode IDs, 'ss...' season IDs, or numeric IDs for Bilibili cheese content. That is a semantic mismatch between the advertised input model and the actual supported identifiers in code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script stores Bilibili authentication cookies in plaintext at a fixed path under the user's home directory without any warning, consent flow, or protection controls. If that file is read by another local process, user, backup system, or accidentally shared workspace, the account session can be reused to access the user's Bilibili account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script sends the user's Bilibili cookies in HTTP headers when calling remote API endpoints, which transmits sensitive authentication data over the network. There is no visible warning, confirmation, or explanatory comment informing the user that their authenticated session will be used for outbound requests.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/cheese_downloader.py (reported line 123)May include surrounding context.
python
return cookie_str def get_video_info(bv_id, cookie): url = "https://api.bilibili.com/x/web-interface/view" params = {'bvid': bv_id} headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36',

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/cheese_downloader.py (reported line 134)May include surrounding context.
python
return cookie_str def get_video_info(bv_id, cookie): url = "https://api.bilibili.com/x/web-interface/view" params = {'bvid': bv_id} headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36',

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/download_and_chunk.py (reported line 55)May include surrounding context.
python
return cookie_str def get_video_info(bv_id, cookie): url = "https://api.bilibili.com/x/web-interface/view" params = {'bvid': bv_id} headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36',

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/download_and_chunk.py (reported line 71)May include surrounding context.
python
return cookie_str def get_video_info(bv_id, cookie): url = "https://api.bilibili.com/x/web-interface/view" params = {'bvid': bv_id} headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36',

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The subtitle selection logic explicitly prefers Chinese subtitles whenever available, and otherwise falls back silently, without offering the user a language choice. This is a natural-language locale policy issue because the behavior imposes a specific language preference without opt-in or explanation.
Content: No source excerpt is available for this finding.

Tainted flow: 'target_url' from requests.get (line 106, network input) → requests.get (network output)

Medium

Category: Data Flow
Confidence: 83% confidence
Finding: The script takes a subtitle URL from the Bilibili API response and fetches it without validating the host or scheme. Even though the expected source is Bilibili, a compromised API response, upstream service issue, or manipulated subtitle_url could cause the script to make unintended outbound requests, creating an SSRF-style primitive and potentially exposing the user's network environment.
Content: Scanner excerpt · scripts/download_and_chunk.py (reported line 108)May include surrounding context.
python
if target_url.startswith('//'): target_url = 'https:' + target_url resp = requests.get(target_url) body = resp.json().get('body', []) full_text = "\n".join([b.get('content', '') for b in body]) return full_text

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest describes a skill for downloading Bilibili subtitles, chunking them for LLM processing, and generating summaries from a BV ID or URL. This file implements QR-code account login, persistent session-cookie storage, and a separate mode that lists course episodes by season/series ID instead of directly downloading subtitles, which expands the operational scope beyond the stated user-facing purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The code preferentially selects subtitles whose language code contains zh, which imposes a language choice automatically. There is no user opt-in, configuration, or documented reason for forcing this locale preference.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The code fetches subtitle content from a remote subtitle URL, which is an outbound network operation tied to the user's requested video context. While network access is part of the script's purpose, there is no explicit disclosure in this file that subtitle data will be downloaded from remote endpoints.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.