Security audit

Bilibili Video Downloader

Security checks across malware telemetry and agentic risk

Overview

This skill mostly does what it claims, but some scripts can run unintended local code or make system/account-affecting changes without enough user control.

Review before installing. Do not run the comment or UP-video-list scripts with untrusted or nonnumeric arguments until input handling is fixed. Install yt-dlp yourself in a trusted environment, avoid administrator/root execution, use a dedicated download directory, and treat cookies.txt like a password file.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documentation clearly describes network-capable operations such as searching Bilibili, retrieving metadata/comments/danmaku, and downloading media via yt-dlp, but the skill does not declare corresponding permissions. This creates a permission-model mismatch: users or hosting platforms may not realize the skill performs outbound network access, weakening transparency, review, and policy enforcement.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrases are broad natural-language commands that can cause the system to search and download content with little indication of confirmation gates, scope limits, or user verification. In an agent setting, this increases the chance of unintended activation and automatic file-writing/network activity from casual or ambiguous user input.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documented script downloads files to the local filesystem and attempts to use a local cookies.txt file for authenticated requests, but the documentation does not clearly warn users that it will create output directories/files or consume potentially sensitive browser-exported cookies. This can lead to unintended local writes, privacy exposure, or misuse of authenticated session data, especially in agent-driven or semi-automated environments where users may not realize local state is being accessed.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The download path automatically passes `--cookies cookies.txt` to yt-dlp without any explicit notice, consent prompt, or explanation that account-linked authentication data may be used for network requests. In an agent skill context, this is risky because it can silently access user-account-scoped content or leak behavior tied to the user's authenticated session if a cookies file is present.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script automatically runs `pip3 install yt-dlp` when the dependency is missing, which changes the user's system without explicit confirmation, isolation, or warning. In an agent skill context, silent package installation increases supply-chain and environment-modification risk, especially if executed in privileged or shared environments.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.