ClawHub
Back to skill

Security audit

bili-review

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it advertises for Bilibili summaries, but it also automatically extracts and stores browser login cookies for long-term reuse.

Install only if you are comfortable letting the skill read Bilibili cookies from your browser, store them locally for long-term reuse, and send authenticated requests to Bilibili. Prefer running it in a contained environment or using a dedicated Bilibili account, and remove the saved cookies.txt when you no longer need the skill.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
仅提取 B站 相关域名, 不导出其他网站; 保存为 600 权限."""
    try:
        cmd = [find_ytdlp_python(), str(SCRIPTS_DIR / "extract_cookies.py"), browser, str(output)]
        subprocess.run(cmd, check=True, capture_output=True, text=True, timeout=60)
        if output.exists() and output.stat().st_size > 0:
            os.chmod(output, 0o600)
            return True
Confidence
94% confidence
Finding
The skill executes a local helper script to extract browser cookies and persist them to `cookies.txt`. Even without shell injection, this is a high-risk credential-handling behavior because it accesses sensitive browser authentication material unrelated to a simple summarization task and stores reusable login state on disk for long-lived reuse.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill invokes local scripts and external tools that imply file access, network access, and shell execution, but it does not declare those capabilities or associated permissions. This weakens user consent and reviewability: a user may trigger actions that read local state, invoke subprocesses, or access remote services without explicit disclosure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented behavior goes beyond summarizing Bilibili content and includes extracting browser cookies, validating them, and persisting login state locally. That mismatch is security-relevant because credential handling is much more sensitive than ordinary content summarization, and users may not realize the skill accesses and stores authentication material.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code explicitly states that it will extract login cookies from the user's browser, store them locally, and automatically reuse them for about 150 days. For a summarization-oriented skill, this is an unnecessary credential acquisition and persistence capability that materially increases risk of account compromise, session theft, and unauthorized use if the file or host is exposed.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
This section probes the local environment for Python interpreters, `yt-dlp`, Homebrew paths, and browser-related tooling, then launches subprocesses. That exceeds what users would reasonably expect from a video-summary skill and broadens local attack surface, especially when combined with cookie extraction and execution of environment-discovered binaries.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The README instructs users to automatically extract browser cookies and store them locally, but it does not clearly foreground that cookies are authentication secrets that can grant account access if mishandled. Even though the document later mentions domain filtering and local permissions, the workflow normalizes credential harvesting behavior and lacks an explicit warning, consent language, and handling guidance at the point of use.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill states that it uses local browser cookies to fetch subtitles but does not provide a clear warning that cookies are sensitive authentication artifacts. Without an explicit privacy and credential notice, users may unknowingly expose account access or accept local persistence of login material.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The login/status commands explicitly involve extracting cookies from the browser and saving them locally, yet the documentation provides no security warning, consent flow, or storage details. This raises the risk of credential theft, unintended persistence, or reuse by other local processes if the storage location or protections are weak.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script programmatically decrypts browser cookies and writes authenticated session data to a file, which is sensitive credential material. Even though it filters to Bilibili-related domains, those cookies can still enable account access or authenticated scraping if the output file is exposed, and the script provides no user-facing consent, warning, or safeguards around secure storage and cleanup.

External Transmission

Medium
Category
Data Exfiltration
Content
return False
    opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))
    try:
        req = urllib.request.Request("https://api.bilibili.com/x/web-interface/nav",
                                     headers={'User-Agent': UA, 'Referer': 'https://www.bilibili.com/'})
        with opener.open(req, timeout=15) as resp:
            data = json.loads(resp.read().decode('utf-8'))
Confidence
97% confidence
Finding
This network call validates extracted browser cookies by sending them to Bilibili's authenticated `nav` endpoint. In context, the danger is not merely external transmission but authenticated transmission of harvested session credentials, confirming that the skill actively uses and depends on the user's login session for its operation.

External Transmission

Medium
Category
Data Exfiltration
Content
cj = http.cookiejar.MozillaCookieJar(str(cookie_file))
    cj.load(ignore_discard=True, ignore_expires=True)
    opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))
    req = urllib.request.Request("https://api.bilibili.com/x/web-interface/nav",
                                 headers={'User-Agent': UA})
    data = json.loads(opener.open(req, timeout=15).read().decode())
    return data.get('data', {}).get('uname', '')
Confidence
96% confidence
Finding
This request uses the locally stored cookie jar to query the current logged-in username from Bilibili. That demonstrates continued use of persisted session material and unnecessary handling of authenticated account context for a summarization tool, increasing privacy and account exposure risk.

External Transmission

Medium
Category
Data Exfiltration
Content
def get_wbi_keys(cookie_file: Path = None) -> tuple:
    """获取 WBI 签名所必需的 img_key 和 sub_key."""
    opener = get_cookie_opener(cookie_file)
    req = urllib.request.Request("https://api.bilibili.com/x/web-interface/nav",
                                 headers={'User-Agent': UA})
    try:
        with opener.open(req, timeout=10) as resp:
Confidence
90% confidence
Finding
The call to obtain WBI keys may use the cookie-backed opener when a cookie file exists, meaning authenticated browser-derived cookies can be sent during subtitle retrieval. In isolation the endpoint is routine, but in this skill's context it contributes to unnecessary authenticated use of harvested session state.

External Transmission

Medium
Category
Data Exfiltration
Content
img_key, sub_key = get_wbi_keys(cookie_file)
    signed_params = sign_wbi_params({'aid': aid, 'cid': cid, 'bvid': bvid}, img_key, sub_key)
    query_str = urllib.parse.urlencode(signed_params)
    url = f"https://api.bilibili.com/x/player/wbi/v2?{query_str}"

    opener = get_cookie_opener(cookie_file)
    req = urllib.request.Request(url, headers={
Confidence
90% confidence
Finding
This subtitle request is made through an opener that may include the user's persisted browser cookies, tying ordinary content retrieval to authenticated session use. Because the skill's stated purpose is summarization, coupling it with silent session reuse increases privacy and credential exposure risk without clear necessity.

Unvalidated Output Injection

High
Category
Output Handling
Content
仅提取 B站 相关域名, 不导出其他网站; 保存为 600 权限."""
    try:
        cmd = [find_ytdlp_python(), str(SCRIPTS_DIR / "extract_cookies.py"), browser, str(output)]
        subprocess.run(cmd, check=True, capture_output=True, text=True, timeout=60)
        if output.exists() and output.stat().st_size > 0:
            os.chmod(output, 0o600)
            return True
Confidence
88% confidence
Finding
The dangerous part here is not output injection per se but the execution of a helper that extracts sensitive browser cookies and writes them to disk. In context, the static pattern usefully points to a real security issue: the skill performs privileged credential collection outside what users would expect for content summarization.

Static analysis

No suspicious patterns detected.