Bilibili Notion Pipeline Skill

• Outcome: Review
• Latest audit: May 29, 2026 · 9:27 PM UTC
• Version: 0.1.2

Overview

This skill matches its stated Bilibili-to-Notion purpose, but it can publish videos, modify or archive Notion content, and delete local files with limited built-in safeguards.

Install only if you are comfortable giving it a limited Notion integration token, a trusted upload endpoint/token, and optionally a Bilibili cookie file. Before running, confirm the target Notion page, avoid --replace-children unless you intend to archive the page body, verify whether uploaded videos become public, and do not run cleanup on metadata files you do not trust.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tainted flow: 'UPLOAD_URL' from os.getenv (line 30, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

if not UPLOAD_URL or not UPLOAD_TOKEN:
        return None
    with video_path.open("rb") as fh:
        resp = requests.post(
            UPLOAD_URL,
            headers={"Authorization": f"Bearer {UPLOAD_TOKEN}"},
            files={"file": (video_path.name, fh, "video/mp4")},

• Confidence: 95% confidence
• Finding: resp = requests.post( UPLOAD_URL, headers={"Authorization": f"Bearer {UPLOAD_TOKEN}"}, files={"file": (video_path.name, fh, "video/mp4")}, timeo

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs execution of local Python scripts that download remote content, read environment-backed credentials, write local files, invoke shell-capable tooling, and call external services, yet it declares no permissions or trust boundaries. This creates a real security issue because users and orchestration systems cannot accurately assess or constrain the skill’s access, increasing the chance of over-privileged execution, unintended data exposure, or unsafe automation.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: When --replace-children is set, the pipeline archives every top-level child block on the specified Notion page before writing new content. That is broader than transcript insertion and can destructively erase unrelated page content if the wrong page_id is supplied, which is especially risky in an automation skill operating over existing knowledge-base pages.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The pipeline sends the user's video file to an external upload service without any in-band warning, consent prompt, or destination transparency beyond environment configuration. Because this skill processes user media and can operate automatically, silent third-party transmission materially increases privacy and data-loss risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Archiving all existing Notion page children is a destructive action that can remove unrelated user content, yet the code performs it automatically when a flag is set and without a specific warning about breadth of deletion. In a content-ingestion pipeline, that scope of modification is unusually dangerous because a mistaken page ID can damage valuable notes or databases.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.