bilibili-universal

• Outcome: Review
• Latest audit: Jul 2, 2026 · 10:56 PM UTC
• Version: 0.1.2

Overview

The skill appears to fetch Bilibili content as advertised, but it automatically uses browser or cookie session context and gives weak warnings around sensitive login cookies.

Install only if you are comfortable with a scraper that may use your Bilibili browser/session cookies. Avoid adding SESSDATA or bili_jct unless needed, treat those values like passwords, keep them out of git and shared workspaces, and consider using a separate browser/profile. Expect harvested comments, danmaku, user metadata, and reports to be saved locally under the skill data directory until you delete them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The description understates the actual behavior: beyond simple public-content fetching, the skill supports bulk harvesting, report generation, local data persistence, and danmaku scraping via a separate library path. This mismatch weakens informed consent and can cause users to run broader data-collection and local-storage workflows than expected, especially in agent environments where network and filesystem actions have security and privacy implications.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README instructs users to place live authentication cookies, including SESSDATA and bili_jct, into a local plaintext file without clearly warning that these values are sensitive account credentials. In this skill’s context, those cookies can grant access to a user’s logged-in session and may be exposed through accidental commits, shared workspaces, backups, logs, or overly broad file permissions, making session theft and account misuse more likely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup instructions tell users to copy full Bilibili cookies including SESSDATA and bili_jct into a local file, but do not prominently warn that these are authentication secrets that can enable account takeover or privileged session abuse if exposed. Because the skill also performs file reads/writes and may run in shared or automated environments, encouraging raw credential export materially increases the chance of accidental leakage, reuse, or exfiltration.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill writes scraped data, including user metadata, comments, and potentially sensitive behavioral content, to disk as JSON without any explicit warning, minimization, or retention control. In an agent setting, this can silently create local data stores of third-party content and account-linked browsing results that users may not expect.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script explicitly routes requests through agent-browser with credentials:'include' and advertises reuse of buvid cookie and logged-in state, which means requests may transmit authenticated browser context and account-linked identifiers to bilibili APIs. Without a clear privacy/safety warning or consent boundary, users may unknowingly expose logged-in session context and receive more sensitive data than intended.

External Transmission

Medium

• Category: Data Exfiltration

Content

def bvid_to_aid(bvid):
    """BV 号 → aid (通过 web-interface/view 拿)"""
    js = f"""(async () => {{
      const r = await fetch('https://api.bilibili.com/x/web-interface/view?bvid={bvid}', {{credentials:'include'}});
      const j = await r.json();
      return JSON.stringify({{code: j.code, aid: j?.data?.aid, title: j?.data?.title, msg: j.message}});
    }})()"""

• Confidence: 90% confidence
• Finding: This function sends requests to an external bilibili API using credentials:'include', which can attach browser cookies and account-linked context to the outbound request. In this skill, external transmission is expected, but the authenticated-context reuse increases privacy risk and can expose session-derived data beyond anonymous scraping.

External Transmission

Medium

• Category: Data Exfiltration

Content

for page in range(1, args.pages + 1):
        js = f"""(async () => {{
          const kw = {json.dumps(keyword)};
          const url = 'https://api.bilibili.com/x/web-interface/search/type'
            + '?search_type=video'
            + '&keyword=' + encodeURIComponent(kw)
            + '&order={args.order}'

• Confidence: 90% confidence
• Finding: The search path transmits user-provided search terms to bilibili and includes browser credentials, potentially linking the query to a logged-in account or device identity. The danger is primarily privacy-related, especially because the skill emphasizes automatic cookie reuse rather than explicit consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

js = f"""(async () => {{
      const kw = {json.dumps(keyword)};
      const url = 'https://api.bilibili.com/x/web-interface/search/type'
        + '?search_type=bili_user'
        + '&keyword=' + encodeURIComponent(kw)
        + '&page=1&page_size=20';

• Confidence: 89% confidence
• Finding: User-search requests send searched usernames and included credentials to bilibili APIs, creating a link between operator queries and account/browser identity. This is not covert exfiltration to an attacker-controlled host, but it is still an external transmission with privacy implications in an agent environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

elif vid.lower().startswith('av'):
        aid = int(vid[2:])
        js = f"""(async () => {{
          const r = await fetch('https://api.bilibili.com/x/web-interface/view?aid={aid}', {{credentials:'include'}});
          const j = await r.json();
          return JSON.stringify({{bvid: j?.data?.bvid, code: j.code}});
        }})()"""

• Confidence: 88% confidence
• Finding: This request resolves AV identifiers through bilibili while including browser credentials. The endpoint is legitimate, but the repeated use of authenticated context for otherwise public lookups expands unnecessary exposure of account-linked metadata.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 详情
    detail_js = f"""(async () => {{
      const r = await fetch('https://api.bilibili.com/x/web-interface/view?bvid={bvid}', {{credentials:'include'}});
      const j = await r.json();
      const v = j?.data;
      if (!v) return JSON.stringify({{code: j.code, msg: j.message}});

• Confidence: 90% confidence
• Finding: Fetching video details from bilibili is core functionality, but the inclusion of browser credentials means even public content retrieval is tied to a persistent session context. In this skill, that makes the external transmission more sensitive than a plain anonymous API call.

External Transmission

Medium

• Category: Data Exfiltration

Content

if args.comments > 0:
        aid = detail['aid']
        comments_js = f"""(async () => {{
          const r = await fetch('https://api.bilibili.com/x/v2/reply/main?oid={aid}&type=1&mode=3&next=0&ps={args.comments}', {{credentials:'include'}});
          const j = await r.json();
          const replies = (j?.data?.replies || []).map(rp => ({{
            rpid: rp.rpid, uname: rp.member?.uname, mid: rp.member?.mid,

• Confidence: 91% confidence
• Finding: Comment retrieval sends content requests to bilibili with included credentials and collects user-generated data that may contain personal information. Combined with local storage support elsewhere in the script, this increases privacy and data-handling risk even though the destination host is expected.

External Transmission

Medium

• Category: Data Exfiltration

Content

return 1
    else:
        js = f"""(async () => {{
          const r = await fetch('https://api.bilibili.com/x/web-interface/view?bvid={bvid}', {{credentials:'include'}});
          const j = await r.json();
          return JSON.stringify({{code: j.code, aid: j?.data?.aid, title: j?.data?.title}});
        }})()"""

• Confidence: 88% confidence
• Finding: This lookup again transmits a BV identifier to bilibili using credentialed browser context. Repeated authenticated external calls across the skill create a consistent privacy risk profile, especially when users may not realize their session is being reused.

External Transmission

Medium

• Category: Data Exfiltration

Content

next_offset = 0
    for page in range(args.pages):
        js = f"""(async () => {{
          const r = await fetch('https://api.bilibili.com/x/v2/reply/main?oid={aid}&type=1&mode=3&next={next_offset}&ps={args.ps}', {{credentials:'include'}});
          const j = await r.json();
          const replies = (j?.data?.replies || []).map(rp => ({{
            rpid: rp.rpid, uname: rp.member?.uname, mid: rp.member?.mid,

• Confidence: 91% confidence
• Finding: Paged comment retrieval repeatedly transmits video identifiers and collects user comment data from an external service while using authenticated browser state. This amplifies both privacy exposure and data-volume risk compared with a single metadata request.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: bili-fetch.py:14