T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/download_video.py:51- Finding
Unrestricted URLs Allow Out-of-Scope Network Requests
- Content
View full analysis
- Remediation
View remediation
Security audit
bilibili-video-search-and-download
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-built for Bilibili search and downloads, but it should be reviewed because it recommends using Chrome browser cookies and allows unvalidated download URLs.
Review before installing. Use this only in a constrained workspace, avoid the Chrome cookie command unless you understand it can expose authenticated session material, and prefer exported cookies limited to Bilibili. Only pass Bilibili URLs or BV IDs, and consider pinning dependencies instead of using mutable latest packages or a public fallback mirror.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:28- Finding
Unpinned Dependencies and Fallback Package Mirror Create Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The supplied code chunk is narrowly focused on downloading one Bilibili video from a provided URL or BV identifier using yt-dlp. That partially matches the declared download aspect, but the declared description materially overstates the skill’s functionality by claiming keyword search, metadata retrieval, and JSON persistence of search results. None of those behaviors appear in this code. There is no undeclared harmful behavior; the mismatch is that the implementation is significantly narrower than the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The code matches the search-and-save portions of the description: it queries Bilibili by keyword, retrieves metadata such as title, author, play count, duration, and BV号, and saves results to a JSON file. However, the declared purpose prominently includes downloading Bilibili videos and using yt-dlp, neither of which appears in the supplied code. This is a material description/behavior mismatch because a core advertised capability is missing from the implementation.
- Content
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
- Category
- YARA Match
- Confidence
- 98% confidence
- Finding
The
--cookies-from-browser chromeinstruction tells the tool to extract authentication cookies from the user's browser profile. Even if intended for legitimate authenticated downloads, this overlaps with credential-harvesting behavior because it accesses sensitive session material that can authenticate as the user; in an agent or shared environment, that is especially dangerous.- Content
行 cd /path/to/project /tmp/bilibili_venv/bin/python3 .opencode/skill/.../scripts/download_video.py BVxxxx
❌ 错误：会在 scripts/ 旁边创建 downloads/
cd .opencode/skill/.../scripts/ python3 download_video.py BVxxxx
text ### 5. Authentication for HD Quality Without login, Bilibili limits downloads to 480P. For 1080P+/4K, pass browser cookies: ```bash /tmp/bilibili_venv/bin/yt-dlp --cookies-from-browser chrome \ -o "downloads/%(title)s.%(ext)s" \ --merge-output-format mp4 \ "https://www.bilibili.com/video/BV1qD4y1U7fs"6. Filename Handling
yt-dlp keeps Chinese characters and punctuation (【】《》~, etc.) in filenames as-is. This can cause shell globbing issues when using
rmor other commands. Always quote file paths with double quotes.Download Script
python # scripts/download_video.py import subprocess import sys from pathlib import Path DOWNLOAD_DIR = Path("downloads") def download_video(url: str, output_dir: Path): output_dir.mkdir(
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill clearly instructs use of shell commands, network access, and file writes, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, this increases the chance the skill is invoked with broader capabilities than users or reviewers expect, enabling unintended network calls, package installation, and filesystem modification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill advises using browser cookies for higher-quality downloads but does not provide a strong privacy and credential-handling warning. Browser cookies can grant authenticated session access; encouraging their extraction and use in command lines materially raises the risk of account compromise, overcollection of sensitive data, or accidental disclosure through logs and shell history.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def download_video(url: str, output_dir: Path): output_dir.mkdir(parents=True, exist_ok=True) print(f"正在下载: {url}") result = subprocess.run( [ sys.executable, "-m", "yt_dlp", "-o", str(output_dir / "%(title)s.%(ext)s"),
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script claims to be Bilibili-specific, but any non-BV argument is treated as an arbitrary URL and passed directly to yt_dlp. In an agent setting, this expands the trust boundary and can enable misuse such as downloading from unintended domains, accessing attacker-controlled endpoints, or triggering network requests inconsistent with the skill's declared purpose.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md async def search_videos(keyword: str, page: int = 1, page_size: int = 20): url = "https://api.bilibili.com/x/web-interface/search/type" params = { "search_type": "video", "keyword": keyword,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python async def search_videos(keyword: str, page: int = 1, page_size: int = 20): url = "https://api.bilibili.com/x/web-interface/search/type" params = { "search_type": "video", "keyword": keyword,
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The embedded script's user-facing prompts and status messages are entirely in Chinese, such as the usage and download messages, with no indication that the user can choose another language. This can violate language/locale policy when a skill imposes a specific language without opt-in or documented regional justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code presents all user-facing status, error, and usage messages in Chinese only, including the main progress output and CLI help text. That can violate a language/locale policy when a skill is expected to be language-neutral or to offer user opt-in for locale selection.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This code sends the user-provided search keyword to an external Bilibili API via an HTTP GET request. Although the script prints when results are saved, there is no user-facing disclosure before transmission that the keyword will be sent to a third-party service.
- Content