Security audit
Security checks across malware telemetry and agentic risk
This skill is a Bilibili data-collection helper that does what it advertises, but users should treat any optional Bilibili cookies and saved harvest files as sensitive.
Install only if you are comfortable with a Bilibili scraping tool that can use your agent-browser/Bilibili session. Avoid adding SESSDATA or bili_jct unless you need authenticated results, never commit or share cookie files, and periodically delete harvest outputs that contain comments, user IDs, or other collected data.
def bvid_to_aid(bvid):
"""BV 号 → aid (通过 web-interface/view 拿)"""
js = f"""(async () => {{
const r = await fetch('https://api.bilibili.com/x/web-interface/view?bvid={bvid}', {{credentials:'include'}});
const j = await r.json();
return JSON.stringify({{code: j.code, aid: j?.data?.aid, title: j?.data?.title, msg: j.message}});
}})()"""for page in range(1, args.pages + 1):
js = f"""(async () => {{
const kw = {json.dumps(keyword)};
const url = 'https://api.bilibili.com/x/web-interface/search/type'
+ '?search_type=video'
+ '&keyword=' + encodeURIComponent(kw)
+ '&order={args.order}'js = f"""(async () => {{
const kw = {json.dumps(keyword)};
const url = 'https://api.bilibili.com/x/web-interface/search/type'
+ '?search_type=bili_user'
+ '&keyword=' + encodeURIComponent(kw)
+ '&page=1&page_size=20';elif vid.lower().startswith('av'):
aid = int(vid[2:])
js = f"""(async () => {{
const r = await fetch('https://api.bilibili.com/x/web-interface/view?aid={aid}', {{credentials:'include'}});
const j = await r.json();
return JSON.stringify({{bvid: j?.data?.bvid, code: j.code}});
}})()"""# 详情
detail_js = f"""(async () => {{
const r = await fetch('https://api.bilibili.com/x/web-interface/view?bvid={bvid}', {{credentials:'include'}});
const j = await r.json();
const v = j?.data;
if (!v) return JSON.stringify({{code: j.code, msg: j.message}});if args.comments > 0:
aid = detail['aid']
comments_js = f"""(async () => {{
const r = await fetch('https://api.bilibili.com/x/v2/reply/main?oid={aid}&type=1&mode=3&next=0&ps={args.comments}', {{credentials:'include'}});
const j = await r.json();
const replies = (j?.data?.replies || []).map(rp => ({{
rpid: rp.rpid, uname: rp.member?.uname, mid: rp.member?.mid,return 1
else:
js = f"""(async () => {{
const r = await fetch('https://api.bilibili.com/x/web-interface/view?bvid={bvid}', {{credentials:'include'}});
const j = await r.json();
return JSON.stringify({{code: j.code, aid: j?.data?.aid, title: j?.data?.title}});
}})()"""next_offset = 0
for page in range(args.pages):
js = f"""(async () => {{
const r = await fetch('https://api.bilibili.com/x/v2/reply/main?oid={aid}&type=1&mode=3&next={next_offset}&ps={args.ps}', {{credentials:'include'}});
const j = await r.json();
const replies = (j?.data?.replies || []).map(rp => ({{
rpid: rp.rpid, uname: rp.member?.uname, mid: rp.member?.mid,65/65 vendors flagged this skill as clean.
Detected: suspicious.dynamic_code_execution