Security audit

bilibili-video-analysis

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Bilibili video-research purpose, with notable caution around optional media/ASR setup and any manually supplied cookies.

Install only if you are comfortable with a Bilibili-focused tool making network requests and writing caches. Run setup plans before applying them, avoid supplying browser cookies unless you understand the account risk, and treat optional ASR setup like installing a large third-party ML stack.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: scripts/cli/commands/setup.ts:477
Finding: ASR Dependencies and Model Artifacts Are Downloaded Without Cryptographic Integrity Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/visual/get.ts:484
Finding: Authentication Cookies Can Be Forwarded to Unvalidated Media URLs
Content: View full analysis
= { "User-Agent": userAgent, "Referer": "https://www.bilibili.com", ...(dependencies.cookie ? { cookie: dependencies.cookie } : {}), }; const videoKey = makeVideoKey({ bvid: metadata.bvid, cid, quality: stream.quality, resolution: input.resolution, }); const sourcePath = join(tempDir, videoKey, "source.mp4"); let downloaded: DownloadedSource; try { downloaded = await downloadVideoSource({ stream, sourcePath, fetchImpl, headers: downloadHeaders, timeoutMs: downloadTimeoutMs, }); ``` `scripts/visual/get.ts:803-835`: ```ts async function downloadVideoSource(args: DownloadSourceArgs): Promise { const { stream, sourcePath, fetchImpl, headers, timeoutMs } = args; if (stream.durlUrls && stream.durlUrls.length === 1 && stream.durlUrls[0]) { const url = stream.durlUrls[0]; const { size } = await downloadToFileStream({ url, destPath: sourcePath, fetchImpl, headers, timeoutMs, }); return { sourcePath, sizeBytes: size, kind: "durl", actualQuality: stream.quality }; } if (stream.durlUrls && stream.durlUrls.length > 1) { throw new BilibiliError({ code: "playurl_no_video_stream", message: `durl 多 fragment (${stream.durlUrls.length} 段) 暂不支持拼装, M5.1a 仅支持单文件 durl`, retryable: false, }); } if ((!stream.durlUrls || stream.durlUrls.length === 0) && stream.videoBaseUrl) { const { size } = await downloadToFileStream({ url: stream.videoBaseUrl, destPath: sourcePath, fetchImpl, headers, timeoutMs, }); return { sourcePath, sizeBytes: size, kind: "dash", actualQuality: stream.quality }; } ``` ### Technical Analysis Wh ...[truncated 2416 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (208)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 41)May include surrounding context.
text
# 本地环境变量 .env .env.local .env.*.local scripts/prototype/__pycache__/

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 42)May include surrounding context.
text
# 本地环境变量 .env .env.local .env.*.local scripts/prototype/__pycache__/ __pycache__/

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Version and compatibility checking is not dangerous by itself, but when bundled into a skill described as pure Bilibili research it contributes to hidden capability creep. The main risk is transparency and over-privileging rather than direct exploitation of the compatibility logic.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/build-release.mjs:35

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/cli/commands/setup.ts:276

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/subtitle/asr/runner.ts:176

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/verify-release.mjs:9

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/visual/frame-extractor.ts:379

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/visual/media-probe.ts:175

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/visual/scene-detector.ts:108

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tests/unit/run-tool.test.ts:21

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/python/test_audio_download.py:18

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/python/test_pipeline_contract.py:11