videolink-to-article

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:58 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for video subtitle extraction, but it asks users to install persistent unverified downloader executables and handle browser session cookies in ways that require careful review.

Review before installing. Prefer already-installed trusted BBDown/yt-dlp binaries or package-manager installs, avoid third-party GitHub proxy mirrors unless you accept that trust risk, and do not add the tools directory to PATH unless you want a persistent system change. Only use cookies after an unauthenticated subtitle request fails; treat cookies.txt and BBDown cookie strings like passwords, keep them task-local, restrict access, and delete them after use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: references/install_tools.md:39

Finding

Unverified Executable Downloads from Third-Party GitHub Proxies

Content

View full analysis

" # is chosen by the invoking agent (recommended: ~/bin/videolink-to-article/) New-Item -ItemType Directory -Force -Path $tools | Out-Null $mirrors = @( "https://gh-proxy.com/https://github.com/nilaoda/BBDown/releases/download/1.6.3/BBDown_1.6.3_20240814_win-x64.zip", "https://ghproxy.net/https://github.com/nilaoda/BBDown/releases/download/1.6.3/BBDown_1.6.3_20240814_win-x64.zip", "https://mirror.ghproxy.com/https://github.com/nilaoda/BBDown/releases/download/1.6.3/BBDown_1.6.3_20240814_win-x64.zip" ) foreach ($u in $mirrors) { curl.exe -L --max-time 60 -o "$tools\BBDown.zip" $u if ((Test-Path "$tools\BBDown.zip") -and ((Get-Item "$tools\BBDown.zip").Length -gt 100000)) { break } Remove-Item "$tools\BBDown.zip" -ErrorAction SilentlyContinue } Expand-Archive -Path "$tools\BBDown.zip" -DestinationPath $tools -Force Remove-Item "$tools\BBDown.zip" ``` The same guide downloads the standalone yt-dlp executable without integrity verification: ```powershell $tools = "" # recommended: ~/bin/videolink-to-article/ New-Item -ItemType Directory -Force -Path $tools | Out-Null # Direct from GitHub. If TLS handshake fails, switch to the gh-proxy.com mirror below. curl.exe -L --max-time 600 --retry 2 -o "$tools\yt-dlp.exe" ` "https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp.exe" # Mirror fallback for restrictive networks: # curl.exe -L --max-time 600 --retry 2 -o "$tools\yt-dlp.exe" ` # "https://gh-proxy.com/https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp.exe" & "$tools\yt-dlp.exe" ...[truncated 2205 chars]

Remediation

View remediation

" $actual = (Get-FileHash "$tools\BBDown.zip" -Algorithm SHA256).Hash.ToLowerInvariant() if ($actual -ne $expected.ToLowerInvariant()) { Remove-Item "$tools\BBDown.zip" -Force throw "BBDown integrity verification failed" } ``` 5. Validate Authenticode signatures where the publisher provides signed Windows artifacts. 6. Do not treat file size, archive validity, or successful `--version` output as proof of authenticity. 7. Do not automatically fall back to third-party executable mirrors. Require explicit user approval and display the trust implications. 8. Extract downloads into a temporary staging directory, verify the expected filenames, and only then move verified artifacts into the persistent tools directory. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/auth.md:59

Finding

Session Cookies Exposed Through Command-Line Arguments and Long-Term Storage

Content

View full analysis

\Downloads\www.youtube.com_cookies.txt" ` --write-auto-subs --sub-langs "" --skip-download "" # Bilibili (BBDown takes a single-line cookie STRING, not a file path): BBDown.exe "" --cookie "" ``` ```bash # POSIX yt-dlp --cookies "/path/to/cookies.txt" --write-auto-subs --sub-langs "" --skip-download "" ``` ```text For BBDown's `--cookie`, extract `SESSDATA=...; bili_jct=...; DedeUserID=...` from the exported file and concatenate into a single line separated by `; `. Cookie file lifetime. Stays valid as long as the browser session remains logged in (typically weeks to months). Re-export only when auth errors return. Storing under `/cookies/.txt` makes it reusable. ``` ### Technical Analysis The Bilibili workflow places a complete authenticated session cookie directly in a process argument. Depending on the operating system and shell, command arguments may be visible through process inspection, diagnostic tooling, command history, terminal logging, or endpoint monitoring. Anyone able to recover the argument may be able to replay the session without knowing the account password. The guide also recommends storing cookie files in the persistent tools directory for reuse. It does not require restrictive filesystem permissions, encryption, short retention, or a dedicated secrets location. This expands the lifetime and exposure of credentials beyond the individual subtitle task. The guide contains a later security reminder, but the operational recommendation still allows durable plaintext credentials and does not technically enforce the stated protections. ### Attack Path 1. The user exports active YouTube or Bilibili cookies. 2 ...[truncated 1230 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: references/install_tools.md:129

Finding

Persistent PATH Modification Exceeds the Requirements of Subtitle Extraction

Content

View full analysis

` (apply in order, stop at first match): 1. Reuse the agent's existing binary cache directory (`binaries/`, `bin/`, `tools/` under per-user data) as `/videolink-to-article/`. 2. Otherwise OS default — Windows: `~/bin/videolink-to-article/`; macOS: `~/Library/Application Support/videolink-to-article/bin/`; Linux: `~/.local/bin/videolink-to-article/`. 3. Never use a workspace folder, system temp, or cache-style dir — tools must survive across sessions. 4. After install, register `` on the user's persistent PATH. ``` Windows persistence: ```powershell $tools = "" # the same path you installed the binaries into $current = [Environment]::GetEnvironmentVariable("Path", "User") # Idempotent check: skip if already present if (($current -split ';') -notcontains $tools) { $new = if ($current) { "$current;$tools" } else { $tools } [Environment]::SetEnvironmentVariable("Path", $new, "User") Write-Host "Added $tools to user PATH. Open a NEW PowerShell window to take effect." } else { Write-Host "$tools is already on PATH." } ``` POSIX persistence: ```bash TOOLS_DIR="$HOME/bin/videolink-to-article" if ! echo "$PATH" | tr ':' '\n' | grep -qx "$TOOLS_DIR"; then echo "export PATH=\"$TOOLS_DIR:\$PATH\"" >> ~/.bashrc echo "Added $TOOLS_DIR to PATH in ~/.bashrc. Open a new shell or run 'source ~/.bashrc'." fi ``` ### Technical Analysis Persistent PATH registration is not required for the declared task. The Skill already supports explicit BBDown and yt-dlp paths, and `fetch_metadata.py` accepts `--bbdown` and `--ytdlp` arguments. Therefore, the tools can be invoked by absolute path without altering the environment of unrelated future shells ...[truncated 1747 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This code chunk is a metadata fetcher, not a transcript extractor. For Bilibili it runs BBDown with --only-show-info and parses informational output; for YouTube it runs yt-dlp with --skip-download and --print to obtain structured metadata. The output is JSON containing platform, video ID, title, uploader, uploader URL, duration, publish date, and canonical URL. There is no subtitle download logic, no parsing of subtitle tracks, no transcript cleaning, and no Markdown generation. Because the declared description centers on transcript/article/subtitle extraction while the actual code only gathers metadata, this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code chunk’s primary function is local post-processing of already-produced transcript files: it sanitizes a title from metadata.json and renames transcript.md/transcript_*.md files accordingly. That is materially different from the declared purpose of accepting Bilibili/YouTube URLs, using BBDown/yt-dlp to fetch subtitles, and producing a Markdown transcript. While file renaming could be a supporting step in a larger pipeline, this specific chunk does not implement the declared core behavior and instead exposes a distinct filesystem-renaming capability not described in the skill summary.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code chunk’s behavior is materially narrower and different from the declared description. Its primary function is post-processing an already-existing SRT subtitle file into sentence-like text lines. The declared purpose, however, centers on fetching subtitles from external video platforms using downloader tools and producing a final Markdown transcript. Those key capabilities are absent from the code shown. While SRT cleanup could be a supporting component within such a larger skill, this specific chunk does not accurately represent the declared end-to-end functionality on its own.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared description presents a subtitle-download-and-transcript skill for Bilibili/YouTube URLs. This code instead performs a much narrower post-processing task: converting a pre-downloaded YouTube srv3 XML subtitle file into SRT and plain text. While this is related to subtitle handling, the primary behavior materially differs from the declared purpose because key advertised capabilities—URL handling, platform download, Bilibili support, and Markdown transcript generation—are absent from the code shown.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 88% confidence

Finding

The info-stealer signature is triggered because the skill includes steps to extract browser cookies and solicit a cookies.txt file from the user. In context, this is not obvious malware, but it is still dangerous because it normalizes credential extraction and account-session transfer within an automation workflow, creating a real opportunity for credential misuse or accidental exposure.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

s/auth.md`).

YouTube:

bash

yt-dlp --list-subs --skip-download "<URL>"

If the command fails with an authentication error (e.g. "Sign in to confirm you're not a bot", "Sign in to confirm your age", HTTP 403), follow this auth resolution flow in order, stopping at the first success:

1. Try --cookies-from-browser (fastest if it works):

   powershell

   yt-dlp --cookies-from-browser edge --list-subs --skip-download "<URL>"
   

   If this fails with Could not copy Chrome cookie database → close all browser instances and retry. If it fails with Failed to decrypt with DPAPI (App-Bound Encryption on Chromium ≥ v127), skip to step 2 — this error is unrecoverable.

2. Ask the user for a cookies.txt file. This is the most reliable method. Present the following guidance to the user:

   YouTube 需要登录态才能获取字幕，但自动读取浏览器 Cookie 失败了。

   请按以下步骤导出 cookies.txt 文�

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to request and reuse browser-derived authentication cookies without a strong privacy and credential-sensitivity warning. Cookies.txt can grant account access equivalent to a logged-in browser session, so mishandling, storage, reuse, or logging of that file could expose the user's YouTube/Google account and related data.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/auth.md (reported line 85)May include surrounding context.

only when auth errors return. Storing under <TOOLS_DIR>/cookies/<site>.txt makes it reusable.

---

Method 3: yt-dlp --cookies-from-browser (YouTube) — limited reliability on modern Chromium

⚠️ 此方法在现代 Chromium 上经常失败，优先使用 Method 2（cookies.txt）。

powershell

# Replace <lang> with the source language code from --list-subs
yt-dlp --cookies-from-browser edge --write-auto-subs --sub-langs "<lang>" --skip-download "<URL>"

Supported browsers: chrome, chromium, edge, firefox, brave, opera, vivaldi, safari (macOS).

⚠️ Frequently fails on modern Chromium. Two failure modes — only the first is recoverable:

Failure	Symptom	Recoverable?
Cookie DB locked by running browser	ERROR: Could not copy Chrome cookie database (issue #7271)	Yes — fully close the browser (kill all background msedge.exe/chrome.exe in Task Manager, including processes from "let Edge r

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/install_tools.md (reported line 164)May include surrounding context.

dows do not see the update. Verify in a fresh PowerShell:

powershell

Get-Command BBDown
Get-Command yt-dlp

Both should resolve to the path inside <TOOLS_DIR>.

POSIX (Linux / macOS)

Append to the user's shell rc file (~/.bashrc, ~/.zshrc, etc.):

bash

TOOLS_DIR="$HOME/bin/videolink-to-article"
if ! echo "$PATH" | tr ':' '\n' | grep -qx "$TOOLS_DIR"; then
    echo "export PATH=\"$TOOLS_DIR:\$PATH\"" >> ~/.bashrc
    echo "Added $TOOLS_DIR to PATH in ~/.bashrc. Open a new shell or run 'source ~/.bashrc'."
fi

Removing from PATH (uninstall)

When uninstalling the skill's tools:

powershell

# Windows
$tools = "<TOOLS_DIR>"
$current = [Environment]::GetEnvironmentVariable("Path", "User")
$new = ($current -split ';' | Where-Object { $_ -ne $tools }) -join ';'
[Environment]::SetEnvironmentVariable("Path", $new, "User")
Remove-Item $tools -Recurse -Force

---

Optional: ffmpeg

Installing real ffmpeg is **not requir

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/troubleshooting.md (reported line 32)May include surrounding context.

md

mptom | Cause | Recovery |
|---|---|---|
| BBDown: "字幕需要登录账号" | Member-only / restricted | `BBDown.exe login` (QR code), then re-run. |
| yt-dlp: "Sign in to confirm your age" | Age-restricted | Use cookies — see `auth.md`. |
| yt-dlp: "Sign in to confirm you're not a bot" | YouTube anti-bot for current IP; affects all unauthenticated paths including direct Innertube calls | Cookies required. Try `--cookies-from-browser firefox` if Firefox is installed; otherwise go straight to manual `cookies.txt` export (`auth.md` § Method 3). Switching `--extractor-args "youtube:player_client=..."` does **not** help once this error appears. |
| yt-dlp: "Could not copy Chrome cookie database" | Browser locking the SQLite db | Close browser fully (kill background `msedge.exe`/`chrome.exe` in Task Manager) and retry; or skip to manual cookies.txt (`auth.md` § Method 3). |
| yt-dlp: "Failed to decrypt with DPAPI" | Chromium ≥ v127 App-Bound Encryption (#10927) | `--cookies-fr

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly instructs use of shell commands, filesystem reads/writes, and environment-dependent installation steps, but it declares no tool scope or permissions boundary. This creates a governance gap where an agent may execute powerful operations without an auditable least-privilege contract, increasing the chance of unsafe tool use or over-broad execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs persistent PATH modification and deletion of intermediate files, both of which change the user's system or remove data beyond the immediate transcript task, yet it provides no explicit consent or warning requirement. Persistent PATH edits can affect future command resolution and system behavior, while automatic cleanup can destroy artifacts the user may expect to retain for audit or recovery.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The embedded guidance shown to the user is written only in Chinese, regardless of the user's preferred language. This imposes a specific language on users without offering a choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/install_tools.md (reported line 29)May include surrounding context.

powershell

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$r = Invoke-RestMethod -Uri "https://api.github.com/repos/nilaoda/BBDown/releases/latest" `
    -UseBasicParsing -Headers @{ "User-Agent"="ps" }
$asset = $r.assets | Where-Object { $_.name -match "win.*x64.*\.zip$" } | Select-Object -First 1
$asset.browser_download_url

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide instructs users to persistently modify their PATH so the downloaded binaries become globally callable in future shells. That exceeds the narrowly scoped task of one-off transcript extraction and creates lasting system-state changes that can increase the blast radius if the downloaded tools are later replaced, shadow existing commands, or are invoked unintentionally by other workflows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Registering a skill-specific tools directory in the user's command resolution path gives those executables ambient availability outside the skill's intended context. While not inherently malicious, this persistence broadens exposure and can enable command hijacking or unreviewed reuse of externally downloaded binaries across unrelated sessions.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/fetch_metadata.py (reported line 142)May include surrounding context.

python

"--ffmpeg-path",
        ffmpeg_placeholder,
    ]
    proc = subprocess.run(
        cmd,
        capture_output=True,
        timeout=60,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/fetch_metadata.py (reported line 188)May include surrounding context.

python

"--ffmpeg-path",
        ffmpeg_placeholder,
    ]
    proc = subprocess.run(
        cmd,
        capture_output=True,
        timeout=60,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script explicitly permits any existing executable to satisfy BBDown's --ffmpeg-path startup check, even though the value is semantically supposed to identify ffmpeg. That broadens the set of binaries the skill will execute or cause BBDown to interact with, creating unnecessary risk if a caller or environment variable points to an attacker-controlled executable; in this skill context, accepting arbitrary executables is not needed for metadata/transcript extraction and increases the attack surface.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Line L041 presents a key recommendation entirely in Chinese, and line L081 repeats a warning in Chinese, without offering an English equivalent in those lines or indicating language choice. This creates a language-policy issue because the skill includes mandatory operational guidance in a specific language without explicit user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The warning at L081 is an operational caution about method reliability, but it is written only in Chinese. Safety-relevant instructions should not depend on a single language unless the skill is explicitly documented as region- or language-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The instructions do make persistent PATH changes, but they understate the operational consequence that future shells and other commands may resolve binaries from this new directory. The missing explicit warning reduces informed consent and can lead users to make broader system configuration changes than they intended.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file includes a Chinese-only error string as a primary troubleshooting symptom, which implies locale-specific expectations for tool output. The document does not state that the skill is limited to Chinese-language environments or offer alternative locale handling, so this can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The user-facing error text tells operators they may pass 'any existing executable path' as --ffmpeg-path, directly normalizing unsafe behavior that defeats the intended meaning of the parameter. While this is primarily a policy and hardening issue rather than a standalone exploit, it increases the chance of unsafe deployment choices and makes the arbitrary-executable acceptance in this script more likely to be exercised.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/fetch_metadata.py (reported line 50)May include surrounding context.

python

# UTF-8 console output so progress messages with CJK paths render correctly
# on legacy Windows code pages (cp936 etc).
for _stream_name in ("stdout", "stderr"):
    _stream = getattr(sys, _stream_name, None)
    if _stream is not None and hasattr(_stream, "reconfigure"):
        try:
            _stream.reconfigure(encoding="utf-8")

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/rename_with_title.py (reported line 48)May include surrounding context.

python

# UTF-8 console output so progress messages with CJK paths render correctly
# on legacy Windows code pages (cp936 etc).
for _stream_name in ("stdout", "stderr"):
    _stream = getattr(sys, _stream_name, None)
    if _stream is not None and hasattr(_stream, "reconfigure"):
        try:
            _stream.reconfigure(encoding="utf-8")

Static analysis

No suspicious patterns detected.