Security audit

Bilibili All In One 1.0.12

Security checks for vulnerabilities and agentic risk

Overview

This Bilibili toolkit mostly matches its stated purpose, but it needs review because it handles browser session cookies, can upload or delete account videos, and may send cookies when fetching an unvalidated subtitle URL.

Review before installing. Use a test Bilibili account, avoid providing session cookies unless you need publishing or high-quality downloads, run it in an isolated virtual environment or container, and do not use the subtitle download path with credentials until URL validation and unauthenticated subtitle fetching are fixed. The publisher actions should be treated as real account-changing operations, including deletion.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: src/subtitle.py:140
Finding: Authenticated Bilibili session cookies can be disclosed to an unvalidated subtitle URL
Content: View full analysis
httpx.AsyncClient: """Create an authenticated async HTTP client. Returns: httpx.AsyncClient configured with credentials. """ return httpx.AsyncClient( headers=self.get_headers(), cookies=self.cookies, timeout=30.0, follow_redirects=True, ) ``` ```python # src/subtitle.py:79-87 for sub in subtitles_info.get("subtitles", []): subtitles.append({ "id": sub.get("id"), "language": sub.get("lan"), "language_name": sub.get("lan_doc"), "url": sub.get("subtitle_url"), "ai_type": sub.get("ai_type", 0), "ai_status": sub.get("ai_status", 0), }) ``` ```python # src/subtitle.py:140-146 # Download subtitle JSON sub_url = target_sub["url"] if sub_url.startswith("//"): sub_url = "https:" + sub_url async with self._get_client() as client: resp = await client.get(sub_url) sub_data = resp.json() ``` ### Technical Analysis The subtitle URL originates in a Bilibili API response and is used as an outbound request destination without validating its scheme or hostname. When a `BilibiliAuth` object is present, `SubtitleDownloader._get_client()` returns the generic authenticated client produced by `BilibiliAuth.get_client()`. That client contains the following sensitive cookies: - `SESSDATA` - `bili_jct` - `buvid3` The client is also configured with `follow_redirects=True`. Consequently, subtitle content is fetched using a client holding account credentials even though downloading the subtitle body does not require authenticated cookies. The implementation does not enforce the domain allowlist declared in ` ...[truncated 1720 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unused and open-ended dependencies unnecessarily expand the installation supply-chain attack surface
Content: View full analysis
=0.24.0 bilibili-api-python>=16.0.0 aiohttp>=3.8.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 requests>=2.31.0 ``` The same dependency set is also advertised by `skill.md:96-104` and declared by `skill.json:14-25`. ### Technical Analysis Only `httpx` is imported by the project runtime. The audit found no runtime imports of: - `bilibili-api-python` - `aiohttp` - `beautifulsoup4` - `lxml` - `requests` Installing these five unused packages and their transitive dependencies provides no functionality required by the reviewed implementation. It nevertheless enlarges the set of third-party code placed into the Skill environment. All dependencies use open-ended lower bounds and the project supplies no lock file or package hashes. Therefore, the exact code installed can change over time without any change to the audited repository. This weakens reproducibility and allows future releases or altered transitive dependency resolutions to enter the environment without review. The audit did not establish that any currently named package is malicious. The confirmed issue is unnecessary and inadequately constrained supply-chain exposure. ### Attack Path 1. A user follows the documented installation command: ```bash pip install -r requirements.txt ``` 2. Pip resolves current versions satisfying the open-ended constraints. 3. Five unused direct dependencies and their transitive dependency trees are downloaded and installed. 4. The resolved package set may differ from the set used during development or audit. 5. If a future direct or transitive release is compromised, malicious or vulnerable code can enter the Skill environment during installation. 6. Such code may affect installation, later imports, or other applications sharing the same ...[truncated 753 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (32)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 78)May include surrounding context.
方式二：凭据文件

创建 credentials.json：

json
{

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code is narrowly focused on download-related functionality. It gets Bilibili video info, queries play URLs, downloads DASH/FLV streams, supports batch downloads, and optionally uses authentication for requests. However, the declared description presents a much broader unified toolkit including trending monitoring, playback, subtitle downloading, publishing, and YouTube oEmbed API access. None of those additional capabilities appear in this code chunk. While the downloader behavior is consistent with part of the description, the description materially overstates what this specific code actually does, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code shown is narrowly focused on monitoring/listing Bilibili trending content. It performs read-only HTTPS requests to Bilibili API endpoints for hot, trending, weekly, and ranking data, and formats video metadata. There is no functionality in this chunk for downloading videos, playing/watching videos, downloading subtitles, publishing content, or calling YouTube oEmbed APIs. While the monitoring portion is consistent with the description, the declared purpose materially overstates the capabilities represented by this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code is narrowly focused on metadata retrieval and engagement tracking for Bilibili videos, plus basic YouTube metadata via oEmbed. It performs HTTP GET requests to Bilibili video info/detail APIs and YouTube oEmbed, and supports optional authenticated client usage through BilibiliAuth. However, it does not implement several major capabilities prominently claimed in the description: no download logic, no actual playback/watch session handling, no subtitle fetching, no publishing/upload flow, and no trending/hot monitoring endpoints. Because the declared description presents a broad unified toolkit while this code chunk only provides watcher/statistics functionality, the description does not accurately represent the supplied code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Yes, this is a mismatch based on the provided code chunk. The description claims a feature-rich Bilibili toolkit with multiple media and API capabilities, but the actual code shown is only an empty tests package initializer. That code does not implement the declared primary purpose or any of the claimed capabilities. While this may be only a partial repository snapshot, evaluating strictly this supplied chunk, the description does not accurately represent what the code actually does.
Content: No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · skill.md (reported line 47)May include surrounding context.
md
# Bilibili All-in-One Skill A comprehensive Bilibili toolkit that integrates hot trending monitoring, video downloading, video watching/playback, subtitle downloading, and video publishing capabilities into a single unified skill. > **⚠️ Required Environment Variables:** `BILIBILI_SESSDATA`, `BILIBILI_BILI_JCT` (required), `BILIBILI_BUVID3` (optional) > These are sensitive Bilibili session cookies needed for authenticated operations (publishing, high-quality downloads). > Features that do NOT require authentication: hot monitoring, standard-quality downloads, subtitle listing, danmaku, stats viewing. > > **📦 Install:** `pip install -r requirements.txt` (all standard PyPI packages: httpx, bilibili-api-python, aiohttp, beautifulsoup4, lxml, requests) > > **🔗 Source:** [github.com/wscats/bilibili-all-in-one](https://github.com/wscats/bilibili-all-in-one) --- ### 何时激活当用户说出或暗示以下内容时，本 Skill 会被激活： | 触发场景 | 匹配的模�

Credential Access

High

Category: Privilege Escalation
Confidence: 81% confidence
Finding: The documentation explicitly instructs users to place live session cookies into a local JSON file, which creates a durable plaintext secret store. Even with later mention of restrictive permissions, this materially increases the exposure window for account-takeover credentials through accidental commits, backups, local malware, or multi-user host access.
Content: Scanner excerpt · skill.md (reported line 120)May include surrounding context.
2. Credential File

Create a JSON file (e.g., credentials.json):

json
{

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The CLI exposes a publisher capability that can upload or publish content to a user's Bilibili account, but the entry point provides no explicit warning, confirmation, or safeguard before invoking an action that causes external state changes. In a skill ecosystem, this increases the risk of accidental or socially engineered account actions, especially because the same unified interface also handles read-only operations, making dangerous actions less distinguishable.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest markets the skill as a very broad 'all-in-one' toolkit and does not define narrow activation constraints, capability boundaries, or routing hints. In platforms that rely on manifest text for discovery or invocation, this can cause over-selection of a powerful skill that has filesystem, network, download, and publishing capabilities, increasing the chance of unintended execution or data-handling actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation rules are extremely broad and include generic Bilibili-related words plus automatic activation on any Bilibili link or BV identifier. In an agent setting, this can cause the skill to trigger in contexts where the user did not explicitly request it, increasing the chance of unnecessary network access, unintended downloads, or prompting for sensitive authentication cookies.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The code removes temporary files and renames intermediate media files as part of merging and fallback handling, but there is no visible warning, confirmation, or user-facing log about these filesystem changes. These are safety-relevant file operations because they modify on-disk state and can overwrite or replace expected artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code performs a file write of downloaded content to a user-specified location, but there is no confirmation prompt, print/log message, or inline warning near the operation. Although the module docstring says it downloads videos, the specific write-to-disk behavior in this execution path is not disclosed to the user at runtime.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest describes a Bilibili toolkit centered on monitoring, downloading, playback, subtitles, and publishing via HTTPS APIs. This code additionally spawns a local executable (ffmpeg) to process media, which is a distinct host-level execution capability not mentioned in the stated purpose or manifest context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code invokes ffmpeg via an asynchronous subprocess, which is a safety-critical operation under the review criteria. There is no confirmation prompt, log/print statement, or nearby disclosure that an external executable will be run as part of the download flow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The delete method performs an irreversible remote deletion by resolving the video ID and sending a deletion request, but it contains no confirmation prompt, warning log, or explicit cautionary note in the method documentation. For a destructive operation, the absence of any visible user disclosure increases the risk of accidental deletion when this skill is invoked programmatically.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency specifier httpx>=0.24.0 is unpinned, so builds may resolve to different versions over time. This weakens supply-chain control and can unexpectedly introduce vulnerable or incompatible releases, especially in a network-facing skill that makes outbound HTTPS requests.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
httpx>=0.24.0 bilibili-api-python>=16.0.0 aiohttp>=3.8.0 beautifulsoup4>=4.12.0

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 83% confidence
Finding: The manifest does not pin httpx, and the package has known advisories in some versions, so the actual installed version cannot be verified as safe. This creates a real supply-chain assurance gap: the environment might resolve to a vulnerable release without visibility in the manifest.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: bilibili-api-python>=16.0.0 allows any later release to be installed, which makes the runtime dependency set non-deterministic. Because this library likely handles authenticated Bilibili interactions, unexpected upstream changes could affect credential handling, request behavior, or pull in compromised transitive dependencies.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
httpx>=0.24.0 bilibili-api-python>=16.0.0 aiohttp>=3.8.0 beautifulsoup4>=4.12.0 lxml>=4.9.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: aiohttp>=3.8.0 is unpinned, so installation may select future releases with unknown security posture or breaking behavior. Since this package is commonly used for HTTP client/server operations, supply-chain drift can directly affect a network-connected skill.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
httpx>=0.24.0 bilibili-api-python>=16.0.0 aiohttp>=3.8.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 requests>=2.31.0

Unverifiable Dependency: aiohttp has 16 known advisory(ies) (CVE-2024-52303 (aiohttp has a memory leak when middleware is enabled when requesting a resource ); CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 87% confidence
Finding: aiohttp has multiple known advisories, but because the dependency is unpinned, there is no way to determine from this file whether deployment will use a fixed or vulnerable version. In a skill that performs network operations, that uncertainty is security-relevant because HTTP stack flaws can affect request handling, cookie management, or parsing behavior.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: beautifulsoup4>=4.12.0 is not version-pinned, which reduces build reproducibility and can unexpectedly introduce upstream changes. While lower risk than core networking libraries, it still expands supply-chain uncertainty for parsing untrusted remote content.
Content: Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
text
httpx>=0.24.0 bilibili-api-python>=16.0.0 aiohttp>=3.8.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 requests>=2.31.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: lxml>=4.9.0 is unpinned despite being a historically sensitive parser with multiple past advisories. In a skill that may process remote HTML/XML/subtitle-related content, uncontrolled upgrades or vulnerable resolved versions can increase exposure to parser-related flaws.
Content: Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.
text
bilibili-api-python>=16.0.0 aiohttp>=3.8.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 requests>=2.31.0

Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 89% confidence
Finding: lxml has a substantial advisory history, and the unpinned requirement means the deployed version is unverifiable from the manifest alone. Given that parser libraries often process attacker-influenced content, unresolved version ambiguity can materially increase risk.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: requests>=2.31.0 is unpinned, so future installations may pull in versions with unknown vulnerabilities or behavior changes. Because this skill performs external HTTP requests and may handle authenticated traffic, deterministic dependency control is important to reduce supply-chain risk.
Content: Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.
text
aiohttp>=3.8.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 requests>=2.31.0

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Credential Access

方式二：凭据文件

Tp4

Tp4

Tp4

Tp4

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

Credential Access

2. Credential File

Undeclared Tool Scope

Missing User Warnings

Vague Triggers

Vague Triggers

Missing User Warnings

Missing User Warnings

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies