Bilibili Video Downloader

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:10 PM UTC
• Version: 1.1.0

Overview

The skill is a Bilibili downloader, but it contains exploitable script inputs and unsafe privilege/cookie guidance that users should review before installing.

Do not install this version unless you are prepared to audit and fix it. Run any testing in a low-privilege sandbox, avoid administrator or sudo execution, do not grant broad writable directories, and do not place real Bilibili cookies in the skill directory. The highest-priority fixes are validating/passing script arguments as data instead of Python source, removing privilege-escalation guidance, and making dependency installation explicit and pinned.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/up-videos.sh:22

Finding

Python Code Injection Through the Uploader UID Argument

Content

View full analysis

Remediation

View remediation

&2 exit 1 } ``` 3. Validate and bound the requested limit: ```bash [[ "$LIMIT" =~ ^[0-9]+$ ]] || exit 1 (( LIMIT >= 1 && LIMIT <= 1000 )) || exit 1 ``` 4. Keep the Agent process unelevated and restrict its filesystem and network permissions. 5. Add automated tests containing quotes, newlines, semicolons, backslashes, and Python syntax in every command-line argument. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/comments.sh:28

Finding

Python Code Injection Through the Comment Limit Argument

Content

View full analysis

Remediation

View remediation

&2 exit 1 } (( LIMIT >= 1 && LIMIT <= 1000 )) || { echo "Comment limit is out of range" >&2 exit 1 } ``` Also validate the complete BV identifier against the expected length and syntax instead of extracting any arbitrary `BV`-prefixed substring. Add regression tests proving that quotes, newlines, parentheses, and semicolons remain inert. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/install-check.sh:19

Finding

Dependency Check Automatically Installs an Unpinned Package

Content

View full analysis

/dev/null; then YTDLP_VERSION=$(yt-dlp --version) echo "✅ yt-dlp: $YTDLP_VERSION" else echo "⚠️ yt-dlp is not installed" echo " Installing..." pip3 install yt-dlp echo "✅ yt-dlp installation completed" fi ``` ### Technical Analysis The script is presented as a dependency checker, but it changes the environment by installing `yt-dlp` automatically when the command is absent. The installation: - Does not request user confirmation. - Does not pin an audited version. - Does not verify package hashes. - Uses whichever package index and pip configuration are active. - Does not isolate the package in a virtual environment. - May affect the user or system Python environment. Python package installation may execute package-controlled build or installation code. Therefore, compromise of the package source, configured index, dependency chain, or a future release can result in local code execution. ### Attack Path 1. A user or Agent runs the documented dependency-check script. 2. `yt-dlp` is not found in `PATH`. 3. The script automatically runs `pip3 install yt-dlp`. 4. Pip resolves mutable package content from its configured package source. 5. Package installation or dependency processing executes with the invoking user's permissions. ### Impact Assessment A compromised dependency or package source could execute arbitrary code with the privileges of the user running the script. It could also modify the Python environment, introduce persistent package-level behavior, or affect unrelated applications sharing that environment. No evidence was found that the named `yt-dlp` package is malicious. The risk arises from automatic, unpinned, and unverified installation behavior. ]]>

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: PERMISSIONS.md:34

Finding

Documentation Encourages Excessive Agent Privileges and Broad Filesystem Access

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cookies.example.txt:1

Finding

Authenticated Bilibili Cookies Are Stored as Unprotected Plaintext

Content

View full analysis

/dev/null || \ yt-dlp "$url" \ --format "$format" \ --output "${output_dir}/%(title)s [%(uploader)s].%(ext)s" \ --merge-output-format mp4 ``` ### Technical Analysis The project instructs users to export authenticated browser cookies and store them as `cookies.txt` inside the script directory. It does not require restrictive filesystem permissions, place the secret outside the distributable Skill directory, provide an ignore rule, or document secure deletion and revocation. `SESSDATA` and related cookies may represent an authenticated Bilibili session. Any process or user able to read the file may be able to reuse the session. The reviewed code does not intentionally transmit these cookies to a non-Bilibili destination. The confirmed issue is insecure local storage and handling, not deliberate exfiltration. ### Attack Path 1. A user exports active browser cookies as directed. 2. The user saves them in `scripts/cookies.txt`. 3. The file receives permissive default permissions, is included in a backup or archive, or is accidentally committed with the project. 4. Another user or attacker reads the cookie values. 5. The attacker replays va ...[truncated 463 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (44)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The uninstall command uses rm -rf against a user-supplied path placeholder. While intended for legitimate cleanup, recursive force deletion is inherently hazardous because an incorrect substitution, copy/paste error, or empty variable/path edit could delete unintended files or directories.

Content

Scanner excerpt · INSTALL.md (reported line 131)May include surrounding context.

Remove-Item -Recurse -Force "C:\Path\To\bilibili-video-downloader"

macOS / Linux

rm -rf /path/to/bilibili-video-downloader

text

依赖（Python、yt-dlp、ffmpeg）不会自动卸载，如需卸载请单独操作。

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The uninstall command uses rm -rf against a user-supplied path placeholder. While intended for legitimate cleanup, recursive force deletion is inherently hazardous because an incorrect substitution, copy/paste error, or empty variable/path edit could delete unintended files or directories.

Content

Scanner excerpt · INSTALL.md (reported line 131)May include surrounding context.

Remove-Item -Recurse -Force "C:\Path\To\bilibili-video-downloader"

macOS / Linux

rm -rf /path/to/bilibili-video-downloader

text

依赖（Python、yt-dlp、ffmpeg）不会自动卸载，如需卸载请单独操作。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

该脚本的核心用途与声明部分一致，确实是一个B站视频搜索/下载工具，并且还能获取基础视频信息。但声明中列出的若干能力在代码中没有实现：没有任何弹幕抓取逻辑、没有评论获取逻辑，也没有按UP主批量下载的命令或流程。代码仅包含 check、search、download、info 四类命令。因此描述对能力范围有明显夸大，属于描述与实际行为不完全一致的情况。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The examples normalize actions that perform network access and write files to disk, including batch downloads and exporting comments/danmaku, without explicitly warning users that these operations contact external services and create local artifacts. In an agent-skill context, this can reduce meaningful user awareness and increase the chance of unintended downloads, storage consumption, or handling of untrusted content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrase examples are broad natural-language requests such as '帮我下载B站上的Python教程视频', which can easily overlap with ordinary conversation and cause the skill to activate when the user is only discussing content rather than intending tool execution. Because this skill can perform searches and downloads automatically, accidental activation can lead to unintended network activity and file writes.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 30)May include surrounding context.

Linux

bash

sudo apt update
sudo apt install python3 python3-pip

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 31)May include surrounding context.

Linux

bash

sudo apt update
sudo apt install python3 python3-pip

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 58)May include surrounding context.

Linux

bash

sudo apt update
sudo apt install python3 python3-pip

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

Linux

bash

sudo apt update
sudo apt install python3 python3-pip

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.

Linux

bash

sudo apt update
sudo apt install python3 python3-pip

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

Linux

bash

sudo apt update
sudo apt install python3 python3-pip

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The installation guide instructs users to export and store Bilibili authentication cookies but does not warn that cookies.txt may contain active session credentials. If the file is stored insecurely, shared, or committed to a repository, an attacker could reuse it to access the user's account or paid content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains user-facing instructions exclusively in Chinese from start to finish. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a locale/language policy issue unless the restriction is clearly justified, which is not stated here.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · PERMISSIONS.md (reported line 61)May include surrounding context.

bash

   # 创建专用目录并设置权限
   mkdir -p ~/AI-Downloads
   chmod 755 ~/AI-Downloads

2. 使用 sudo（不推荐）

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · PERMISSIONS.md (reported line 110)May include surrounding context.

bash

   # 创建专用目录并设置权限
   mkdir -p ~/AI-Downloads
   chmod 755 ~/AI-Downloads

2. 使用 sudo（不推荐）

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The specific use of 'sudo -S' is especially sensitive because it is commonly used in non-interactive or scripted privilege escalation scenarios. In an agent-skill context, normalizing this pattern can encourage unsafe elevation practices and could be repurposed by a malicious or compromised workflow.

Content

Scanner excerpt · PERMISSIONS.md (reported line 67)May include surrounding context.

2. 使用 sudo（不推荐）

   bash

   # 临时提升权限（谨慎使用）
   sudo -S command
   

方案 B：手动执行（推荐普通用户）

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The specific use of 'sudo -S' is especially sensitive because it is commonly used in non-interactive or scripted privilege escalation scenarios. In an agent-skill context, normalizing this pattern can encourage unsafe elevation practices and could be repurposed by a malicious or compromised workflow.

Content

Scanner excerpt · PERMISSIONS.md (reported line 67)May include surrounding context.

2. 使用 sudo（不推荐）

   bash

   # 临时提升权限（谨慎使用）
   sudo -S command
   

方案 B：手动执行（推荐普通用户）

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill documentation presents all user-facing instructions in Chinese, including installation, usage, warnings, and operational guidance. Under the policy provided, forcing a specific language without user opt-in can be a natural-language policy violation when no language choice or locale justification is given.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill documents and encourages network-capable actions such as searching Bilibili, fetching metadata, comments, and danmaku, but it does not declare any explicit tool scope or permission boundary. This increases the chance that an agent runtime may invoke broader network access than users or platform policy expect, reducing transparency and control over outbound requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The trigger phrases are broad, everyday requests like '帮我下载B站上的XX视频' and '搜索B站关于XX的视频', which could cause the skill to activate in normal conversation without clear user intent for tool use. In an agent setting, ambiguous activation can lead to unintended network access, generation of download commands, or file-writing attempts based on casual prompts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language instructions, help text, and examples are presented in Chinese throughout the file, with no indication that users can choose another language. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy issue.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest advertises capabilities to get 弹幕, 评论, and batch-download an UP主's videos, but this script exposes only search, download, info, and dependency-check commands. There is no code path here for comments, danmaku extraction, or uploader-wide batch download, so the implemented behavior is materially narrower than the stated skill behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The hardcoded subtitle language list zh-CN,zh-TW,en imposes a specific locale preference in the skill behavior. There is no visible opt-in, configuration option, or justification that this skill is intentionally region- or language-specific, so it conflicts with the policy against forced language or locale behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The downloader automatically passes a local cookies.txt file to yt-dlp, which may cause authenticated session cookies to be used without explicit user awareness. In an agent skill context, this can access account-scoped or age/region-restricted content and may inadvertently expose or misuse sensitive session data if users place browser-exported cookies in the working directory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's description, usage output, and status messages are all hardcoded in Chinese, which imposes a specific language on users. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.