Bilibili All In One 1.0.12

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:58 AM UTC
• Version: 1.0.0

Overview

This Bilibili toolkit mostly matches its stated purpose, but it needs review because it handles browser session cookies, can upload or delete account videos, and may send cookies when fetching an unvalidated subtitle URL.

Review before installing. Use a test Bilibili account, avoid providing session cookies unless you need publishing or high-quality downloads, run it in an isolated virtual environment or container, and do not use the subtitle download path with credentials until URL validation and unauthenticated subtitle fetching are fixed. The publisher actions should be treated as real account-changing operations, including deletion.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: src/subtitle.py:140
• Finding: Authenticated Bilibili session cookies can be disclosed to an unvalidated subtitle URL<![CDATA[ ## Vulnerability Details **File Location**: `src/subtitle.py:140-146`, with authenticated client construction in `src/auth.py:102-107` **Vulnerability Type**: Sensitive credential disclosure through an unvalidated cross-origin request **Risk Level**: Critical ### Complete Code Snippet ```python # src/auth.py:96-107 def get_client(self) -> httpx.AsyncClient: """Create an authenticated async HTTP client. Returns: httpx.AsyncClient configured with credentials. """ return httpx.AsyncClient( headers=self.get_headers(), cookies=self.cookies, timeout=30.0, follow_redirects=True, ) ``` ```python # src/subtitle.py:79-87 for sub in subtitles_info.get("subtitles", []): subtitles.append({ "id": sub.get("id"), "language": sub.get("lan"), "language_name": sub.get("lan_doc"), "url": sub.get("subtitle_url"), "ai_type": sub.get("ai_type", 0), "ai_status": sub.get("ai_status", 0), }) ``` ```python # src/subtitle.py:140-146 # Download subtitle JSON sub_url = target_sub["url"] if sub_url.startswith("//"): sub_url = "https:" + sub_url async with self._get_client() as client: resp = await client.get(sub_url) sub_data = resp.json() ``` ### Technical Analysis The subtitle URL originates in a Bilibili API response and is used as an outbound request destination without validating its scheme or hostname. When a `BilibiliAuth` object is present, `SubtitleDownloader._get_client()` returns the generic authenticated client produced by `BilibiliAuth.get_client()`. That client contains the following sensitive cookies: - `SESSDATA` - `bili_jct` - `buvid3` The client is also configured with `follow_redirects=True`. Consequently, subtitle content is fetched using a client holding account credentials even though downloading the subtitle body does not require authenticated cookies. The implementation does not enforce the domain allowlist declared in ` ...[truncated 1720 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use a dedicated unauthenticated HTTP client for downloading subtitle content: ```python async with httpx.AsyncClient( headers=DEFAULT_HEADERS, timeout=30.0, follow_redirects=False, ) as client: resp = await client.get(sub_url) ``` 2. Parse and validate every subtitle URL before sending the request: - Require the `https` scheme. - Reject embedded credentials. - Require an explicit allowlist of approved Bilibili subtitle CDN hostnames. - Reject IP literals, localhost, private networks, link-local networks, and metadata endpoints. 3. Disable automatic redirects. If redirects are required, validate the scheme and hostname of every redirect target before following it. 4. Separate network clients by privilege: - Public Bilibili API client without cookies. - Authenticated Bilibili API client with domain-scoped cookies. - Upload client carrying only the upload authorization needed by the relevant endpoint. - YouTube client without Bilibili headers or cookies. 5. Scope cookies explicitly to official Bilibili hosts rather than inserting them into a generic client-level cookie jar. 6. Add regression tests confirming that: - Subtitle CDN requests contain no account cookies. - Non-HTTPS subtitle URLs are rejected. - Unapproved hosts are rejected. - Cross-origin redirects are rejected. - The runtime behavior matches the domain allowlist declared in `skill.json`. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1
• Finding: Unused and open-ended dependencies unnecessarily expand the installation supply-chain attack surface<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-6` **Vulnerability Type**: Unnecessary and insufficiently constrained third-party dependencies **Risk Level**: Medium ### Complete Code Snippet ```text httpx>=0.24.0 bilibili-api-python>=16.0.0 aiohttp>=3.8.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 requests>=2.31.0 ``` The same dependency set is also advertised by `skill.md:96-104` and declared by `skill.json:14-25`. ### Technical Analysis Only `httpx` is imported by the project runtime. The audit found no runtime imports of: - `bilibili-api-python` - `aiohttp` - `beautifulsoup4` - `lxml` - `requests` Installing these five unused packages and their transitive dependencies provides no functionality required by the reviewed implementation. It nevertheless enlarges the set of third-party code placed into the Skill environment. All dependencies use open-ended lower bounds and the project supplies no lock file or package hashes. Therefore, the exact code installed can change over time without any change to the audited repository. This weakens reproducibility and allows future releases or altered transitive dependency resolutions to enter the environment without review. The audit did not establish that any currently named package is malicious. The confirmed issue is unnecessary and inadequately constrained supply-chain exposure. ### Attack Path 1. A user follows the documented installation command: ```bash pip install -r requirements.txt ``` 2. Pip resolves current versions satisfying the open-ended constraints. 3. Five unused direct dependencies and their transitive dependency trees are downloaded and installed. 4. The resolved package set may differ from the set used during development or audit. 5. If a future direct or transitive release is compromised, malicious or vulnerable code can enter the Skill environment during installation. 6. Such code may affect installation, later imports, or other applications sharing the same ...[truncated 753 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all dependencies not imported or otherwise required by runtime behavior. Based on the reviewed code, retain only `httpx` unless additional functionality is added and verified. 2. Replace open-ended constraints with reviewed, reproducible versions. 3. Generate and commit a lock file containing exact direct and transitive versions. 4. Use package hashes and install with hash verification, for example: ```bash pip install --require-hashes -r requirements.txt ``` 5. Install the Skill in a dedicated virtual environment or isolated container rather than a shared Python environment. 6. Add automated dependency review that checks: - Known vulnerabilities. - Unexpected new transitive dependencies. - Package ownership or provenance changes. - Differences between the lock file and installation manifest. 7. Update `skill.md` and `skill.json` so their dependency lists match the minimal reviewed runtime requirements. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (32)

Credential Access

High

• Category: Privilege Escalation

Content

### 方式二：凭据文件

创建 `credentials.json`：

```json
{

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The supplied code is narrowly focused on download-related functionality. It gets Bilibili video info, queries play URLs, downloads DASH/FLV streams, supports batch downloads, and optionally uses authentication for requests. However, the declared description presents a much broader unified toolkit including trending monitoring, playback, subtitle downloading, publishing, and YouTube oEmbed API access. None of those additional capabilities appear in this code chunk. While the downloader behavior is consistent with part of the description, the description materially overstates what this specific code actually does, so this should be flagged as a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code shown is narrowly focused on monitoring/listing Bilibili trending content. It performs read-only HTTPS requests to Bilibili API endpoints for hot, trending, weekly, and ranking data, and formats video metadata. There is no functionality in this chunk for downloading videos, playing/watching videos, downloading subtitles, publishing content, or calling YouTube oEmbed APIs. While the monitoring portion is consistent with the description, the declared purpose materially overstates the capabilities represented by this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code is narrowly focused on metadata retrieval and engagement tracking for Bilibili videos, plus basic YouTube metadata via oEmbed. It performs HTTP GET requests to Bilibili video info/detail APIs and YouTube oEmbed, and supports optional authenticated client usage through BilibiliAuth. However, it does not implement several major capabilities prominently claimed in the description: no download logic, no actual playback/watch session handling, no subtitle fetching, no publishing/upload flow, and no trending/hot monitoring endpoints. Because the declared description presents a broad unified toolkit while this code chunk only provides watcher/statistics functionality, the description does not accurately represent the supplied code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Yes, this is a mismatch based on the provided code chunk. The description claims a feature-rich Bilibili toolkit with multiple media and API capabilities, but the actual code shown is only an empty tests package initializer. That code does not implement the declared primary purpose or any of the claimed capabilities. While this may be only a partial repository snapshot, evaluating strictly this supplied chunk, the description does not accurately represent what the code actually does.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

# Bilibili All-in-One Skill

A comprehensive Bilibili toolkit that integrates hot trending monitoring, video downloading, video watching/playback, subtitle downloading, and video publishing capabilities into a single unified skill.

> **⚠️ Required Environment Variables:** `BILIBILI_SESSDATA`, `BILIBILI_BILI_JCT` (required), `BILIBILI_BUVID3` (optional)
> These are sensitive Bilibili session cookies needed for authenticated operations (publishing, high-quality downloads).
> Features that do NOT require authentication: hot monitoring, standard-quality downloads, subtitle listing, danmaku, stats viewing.
>
> **📦 Install:** `pip install -r requirements.txt` (all standard PyPI packages: httpx, bilibili-api-python, aiohttp, beautifulsoup4, lxml, requests)
>
> **🔗 Source:** [github.com/wscats/bilibili-all-in-one](https://github.com/wscats/bilibili-all-in-one)

---
### 何时激活

当用户说出或暗示以下内容时，本 Skill 会被激活：

| 触发场景 | 匹配的模�

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Credential Access

High

• Category: Privilege Escalation

Content

### 2. Credential File

Create a JSON file (e.g., `credentials.json`):

```json
{

• Confidence: 81% confidence
• Finding: The documentation explicitly instructs users to place live session cookies into a local JSON file, which creates a durable plaintext secret store. Even with later mention of restrictive permissions, this materially increases the exposure window for account-takeover credentials through accidental commits, backups, local malware, or multi-user host access.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The CLI exposes a `publisher` capability that can upload or publish content to a user's Bilibili account, but the entry point provides no explicit warning, confirmation, or safeguard before invoking an action that causes external state changes. In a skill ecosystem, this increases the risk of accidental or socially engineered account actions, especially because the same unified interface also handles read-only operations, making dangerous actions less distinguishable.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The manifest markets the skill as a very broad 'all-in-one' toolkit and does not define narrow activation constraints, capability boundaries, or routing hints. In platforms that rely on manifest text for discovery or invocation, this can cause over-selection of a powerful skill that has filesystem, network, download, and publishing capabilities, increasing the chance of unintended execution or data-handling actions.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The activation rules are extremely broad and include generic Bilibili-related words plus automatic activation on any Bilibili link or BV identifier. In an agent setting, this can cause the skill to trigger in contexts where the user did not explicitly request it, increasing the chance of unnecessary network access, unintended downloads, or prompting for sensitive authentication cookies.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code removes temporary files and renames intermediate media files as part of merging and fallback handling, but there is no visible warning, confirmation, or user-facing log about these filesystem changes. These are safety-relevant file operations because they modify on-disk state and can overwrite or replace expected artifacts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code performs a file write of downloaded content to a user-specified location, but there is no confirmation prompt, print/log message, or inline warning near the operation. Although the module docstring says it downloads videos, the specific write-to-disk behavior in this execution path is not disclosed to the user at runtime.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The manifest describes a Bilibili toolkit centered on monitoring, downloading, playback, subtitles, and publishing via HTTPS APIs. This code additionally spawns a local executable (`ffmpeg`) to process media, which is a distinct host-level execution capability not mentioned in the stated purpose or manifest context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This code invokes ffmpeg via an asynchronous subprocess, which is a safety-critical operation under the review criteria. There is no confirmation prompt, log/print statement, or nearby disclosure that an external executable will be run as part of the download flow.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The delete method performs an irreversible remote deletion by resolving the video ID and sending a deletion request, but it contains no confirmation prompt, warning log, or explicit cautionary note in the method documentation. For a destructive operation, the absence of any visible user disclosure increases the risk of accidental deletion when this skill is invoked programmatically.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.24.0
bilibili-api-python>=16.0.0
aiohttp>=3.8.0
beautifulsoup4>=4.12.0

• Confidence: 95% confidence
• Finding: The dependency specifier `httpx>=0.24.0` is unpinned, so builds may resolve to different versions over time. This weakens supply-chain control and can unexpectedly introduce vulnerable or incompatible releases, especially in a network-facing skill that makes outbound HTTPS requests.

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: The manifest does not pin `httpx`, and the package has known advisories in some versions, so the actual installed version cannot be verified as safe. This creates a real supply-chain assurance gap: the environment might resolve to a vulnerable release without visibility in the manifest.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.24.0
bilibili-api-python>=16.0.0
aiohttp>=3.8.0
beautifulsoup4>=4.12.0
lxml>=4.9.0

• Confidence: 95% confidence
• Finding: `bilibili-api-python>=16.0.0` allows any later release to be installed, which makes the runtime dependency set non-deterministic. Because this library likely handles authenticated Bilibili interactions, unexpected upstream changes could affect credential handling, request behavior, or pull in compromised transitive dependencies.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.24.0
bilibili-api-python>=16.0.0
aiohttp>=3.8.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
requests>=2.31.0

• Confidence: 95% confidence
• Finding: `aiohttp>=3.8.0` is unpinned, so installation may select future releases with unknown security posture or breaking behavior. Since this package is commonly used for HTTP client/server operations, supply-chain drift can directly affect a network-connected skill.

Unverifiable Dependency: aiohttp has 16 known advisory(ies) (CVE-2024-52303 (aiohttp has a memory leak when middleware is enabled when requesting a resource ); CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: `aiohttp` has multiple known advisories, but because the dependency is unpinned, there is no way to determine from this file whether deployment will use a fixed or vulnerable version. In a skill that performs network operations, that uncertainty is security-relevant because HTTP stack flaws can affect request handling, cookie management, or parsing behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.24.0
bilibili-api-python>=16.0.0
aiohttp>=3.8.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
requests>=2.31.0

• Confidence: 93% confidence
• Finding: `beautifulsoup4>=4.12.0` is not version-pinned, which reduces build reproducibility and can unexpectedly introduce upstream changes. While lower risk than core networking libraries, it still expands supply-chain uncertainty for parsing untrusted remote content.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

bilibili-api-python>=16.0.0
aiohttp>=3.8.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
requests>=2.31.0

• Confidence: 96% confidence
• Finding: `lxml>=4.9.0` is unpinned despite being a historically sensitive parser with multiple past advisories. In a skill that may process remote HTML/XML/subtitle-related content, uncontrolled upgrades or vulnerable resolved versions can increase exposure to parser-related flaws.

Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: `lxml` has a substantial advisory history, and the unpinned requirement means the deployed version is unverifiable from the manifest alone. Given that parser libraries often process attacker-influenced content, unresolved version ambiguity can materially increase risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

aiohttp>=3.8.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
requests>=2.31.0

• Confidence: 96% confidence
• Finding: `requests>=2.31.0` is unpinned, so future installations may pull in versions with unknown vulnerabilities or behavior changes. Because this skill performs external HTTP requests and may handle authenticated traffic, deterministic dependency control is important to reduce supply-chain risk.

Static analysis

No suspicious patterns detected.