T09 · Insecure Skill Coding Practices
Error
- Location
index.js:134- Finding
Shell Command Injection in Subtitle Download Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
bilibili-subtitle-analysis
Security checks for vulnerabilities and agentic risk
Overview
The skill’s subtitle-analysis purpose is understandable, but it asks users to paste a live Bilibili cookie into OpenClaw and runs external Python code through unsafe shell construction.
Only install after the publisher removes the instruction to paste cookies into chat, switches to local secret storage or another safer auth flow, pins and verifies the external biliSub code and Python dependencies, and replaces shell-based execSync command construction with safe argument-vector execution. Treat any Bilibili cookie as an account credential.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
README.md:19- Finding
Documentation Solicits Disclosure of an Authentication Cookie to the Agent
- Content
View full analysis
- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:137- Finding
Mutable Remote Code and Unpinned Python Dependencies Are Installed and Executed
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The README explicitly instructs users to extract browser cookies from bilibili.com and send them to the agent/service, which is a request for live authentication material unrelated to safe local-only subtitle analysis. Full cookies can enable account session hijacking or broader account abuse if mishandled, logged, or exfiltrated, making this substantially more dangerous in an agent skill context where users may trust the tool and disclose secrets directly.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README asks users to provide Bilibili cookies but gives no warning that these are sensitive authentication secrets or that sharing them can compromise the account. In a skill context, omission of safety guidance materially increases the likelihood of credential disclosure, reuse, storage in logs, or transmission to third parties.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
Telling users to copy browser cookies and send them to 'openclaw' is a direct request for sensitive authentication data disclosure. This creates an immediate path to credential theft or misuse and is especially dangerous because the skill’s stated purpose is subtitle download/analysis, which does not justify transmitting full session cookies to another party.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md const BilibiliSubtitleAnalyzer = require('./index.js');
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill allows
BILI_PYTHON,BILISUB_PATH, and related options/environment variables to control which interpreter and script are executed, then builds a shell command withargs.join(' ')and passes it toexecSync. This combination is dangerous because it permits execution of attacker-controlled binaries/scripts and also introduces command-injection risk if any argument contains shell metacharacters or crafted values.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The activation phrase '直接发视频链接说使用技能bilibili-subtitle-analysis' is broad and weakly constrained, which can cause accidental invocation on arbitrary links or ambiguous user intent. In an agent setting, loose triggering increases the chance that sensitive or unsafe flows, including credential solicitation, are initiated without sufficiently explicit user consent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 81% confidence
- Finding
The skill advertises operational capabilities and includes examples that rely on environment-dependent execution, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope metadata can cause the skill to run with broader-than-necessary access or make its runtime expectations ambiguous, which increases the chance of unintended access to local environment data or execution surfaces.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger conditions are broad enough to match common user requests about downloading subtitles, analyzing content, or generating reports, which can cause the skill to activate outside narrowly intended scenarios. Overbroad triggering is dangerous because it can route unrelated user prompts into a skill that performs external downloads and local processing, increasing the risk of unintended actions and data handling.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill searches multiple broad, environment-derived directories including the current working directory, user home, Downloads, Documents, and Windows user paths to locate and trust an external Python project. This creates an unsafe dependency resolution path: if an attacker can place a malicious
biliSub/enhanced_bilisub.pyin any searched location, the skill may execute it later, resulting in arbitrary code execution under the agent's privileges.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 69% confidence
- Finding
The entire skill description and usage instructions are presented only in Chinese, including the invocation guidance, with no indication that users may choose another language. This can be a natural-language policy issue when a skill effectively requires a specific language without opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code hardcodes
toLocaleString('zh-CN')when generating the summary timestamp, which enforces a specific locale regardless of user preference. This is a natural-language/locale policy issue because the skill does not offer a language or locale choice and does not document why Chinese locale is required.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The description is written only in Chinese ("B站字幕下载分析工具 - 基于 biliSub 项目"), which can indicate a language-specific constraint in the skill metadata without any stated user opt-in or justification. Under the language/locale policy rule, this is a natural-language policy concern because the file provides no indication that users may choose another language or that the scope is intentionally region-specific.
- Content