ClawHub
Back to skill

Security audit

B站（bilibili）视频分析专家

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Bilibili video-analysis purpose, but it needs review because crafted URLs can make it contact unintended hosts and one guide suggests evading rate limits.

Review this skill before installing. Use it only on trusted Bilibili video links or direct BV/AV identifiers, avoid proxy/IP-rotation behavior, and run it in an isolated environment with pinned dependencies if possible. Treat extracted comments, danmaku, uploader data, and cached files as user-generated/public-profile data that may still carry privacy obligations.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/get_video_content.py:76
Finding

Server-Side Request Forgery Through Weak Short-Link Validation

Content
View full analysis
Remediation
View remediation
None: parsed = urlsplit(url) if parsed.scheme != "https": raise ValueError("Only HTTPS URLs are allowed") hostname = (parsed.hostname or "").lower().rstrip(".") if hostname not in ALLOWED_SHORT_LINK_HOSTS: raise ValueError("Unapproved short-link hostname") for result in socket.getaddrinfo(hostname, 443, type=socket.SOCK_STREAM): address = ipaddress.ip_address(result[4][0]) if not address.is_global: raise ValueError("Non-public destination address") validate_public_bilibili_url(url) response = self.session.head( url, allow_redirects=False, timeout=10, ) ``` If redirects are necessary, process them manually and apply equivalent validation to each `Location` destination before issuing the next request. ]]>

T08 · Insecure Dependencies

Note
Location
references/core-workflow.md:46
Finding

Unpinned Runtime Dependency Installation Creates Supply-Chain Exposure

Content
View full analysis
=2.28.0 ``` ```bash pip install openai-whisper yt-dlp # System dependency: ffmpeg ``` ### Technical Analysis The Skill's mandatory workflow instructs users or an Agent to install third-party Python packages directly from the configured pip package index. The installations do not use a lockfile, exact version constraints, package hashes, or an explicitly trusted index. The constraint `requests>=2.28.0` permits any current or future version satisfying the lower bound. The optional `openai-whisper` and `yt-dlp` packages have no version constraints at all. Their transitive dependencies are also mutable. Python package installation may execute build-backend or setup logic. If an upstream package, dependency, package index, or local pip configuration is compromised, code not included in the audited project can execute with the privileges of the user performing the installation. No evidence was found that the named dependencies are typosquatted or intentionally malicious. This finding concerns the non-reproducible and mutable installation process rather than confirmed malicious behavior in those packages. ### Attack Path 1. A user or Agent follows the setup instructions in the required workflow. 2. pip contacts its configured package index and resolves the newest versions satisfying the loose constraints. 3. A package or transitive dependency has been compromised, maliciously replaced, or unexpectedly modified after this Skill was audited. 4. pip downloads and installs the changed artifact. 5. Installation-time code or later imported package code executes under the installing user's account. An environmental variation is also possible: 1. The host has a malicious or unintended pip index configured globally or through en ...[truncated 943 chars]
Remediation
View remediation
--hash=sha256: openai-whisper== --hash=sha256: yt-dlp== --hash=sha256: ``` 5. Generate the lockfile separately for each supported Python version and platform where dependency resolution differs. 6. Specify and document the approved package index, and prevent fallback to untrusted extra indexes. 7. Install packages inside an isolated virtual environment rather than the system Python environment. 8. Do not install optional dependencies unless the user explicitly requests the feature that requires them. 9. Review dependency updates before changing the lockfile, including transitive dependencies and build requirements. 10. Prefer binary wheels from trusted sources where appropriate, while still verifying hashes. 11. Avoid running pip with administrative or root privileges. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (29)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description is written as broad promotional copy and does not define clear activation boundaries, allowed inputs, or concrete trigger conditions. In agent systems, this ambiguity can cause over-invocation, misuse outside intended scope, and increase the chance that downstream instructions such as mandatory loading of additional workflow files are followed inappropriately without sufficient user intent validation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file’s natural-language instructions are fully Chinese from the title onward, and nowhere indicates that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The error-handling guidance explicitly suggests using proxies to work around rate limits and risk controls ('使用代理', '更换IP'). That encourages bypassing service protections and can lead to policy violations, account or IP bans, and operational misuse of the skill in scraping or evasive automation contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown skill file presents all instructions, warnings, prompts, and output requirements exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/core-workflow.md (reported line 275)May include surrounding context.

md
## 资源索引

| 文件                                                                                     | 用途                    |
| ---------------------------------------------------------------------------------------- | ----------------------- |
| [scripts/get_video_content.py](scripts/get_video_content.py)                             | 核心脚本                |
| [scripts/comment_extractor.py](scripts/comment_extractor.py)                             | 评论提取                |

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document title and framing are entirely specified in Chinese, indicating the skill output template is fixed to a specific language. Under the policy, locale or language constraints should either offer user choice or be clearly documented as justified; this file provides neither.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bilibili-api-guide.md (reported line 17)May include surrounding context.

md
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bilibili-api-guide.md (reported line 18)May include surrounding context.

md
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bilibili-api-guide.md (reported line 114)May include surrounding context.

md
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bilibili-api-guide.md (reported line 153)May include surrounding context.

md
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bilibili-api-guide.md (reported line 242)May include surrounding context.

md
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bilibili-api-guide.md (reported line 251)May include surrounding context.

md
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bilibili-api-guide.md (reported line 291)May include surrounding context.

md
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bilibili-api-guide.md (reported line 296)May include surrounding context.

md
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bilibili-api-guide.md (reported line 301)May include surrounding context.

md
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bilibili-api-guide.md (reported line 355)May include surrounding context.

md
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bilibili-api-guide.md (reported line 383)May include surrounding context.

md
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/comment_extractor.py (reported line 30)May include surrounding context.

python
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/comment_extractor.py (reported line 55)May include surrounding context.

python
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/comment_extractor.py (reported line 95)May include surrounding context.

python
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/get_video_content.py (reported line 105)May include surrounding context.

python
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/get_video_content.py (reported line 108)May include surrounding context.

python
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/get_video_content.py (reported line 179)May include surrounding context.

python
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/get_video_content.py (reported line 218)May include surrounding context.

python
def get_video_aid(self, bvid: str) -> Optional[int]:
        """获取视频aid"""
        try:
            url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
            response = self.session.get(url, timeout=10)
            data = response.json()
            if data.get("code") == 0:

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file documents APIs that return comment content, user profile fields, and hashed user identifiers, but it does not include any warning about privacy, responsible handling, or disclosure that user-generated data will be retrieved. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or privacy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.