ClawHub
Back to skill

Security audit

bilibili-upload

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Bilibili upload helper, with some ordinary account-session and dependency risks users should understand.

Install only if you intend to upload chosen videos to Bilibili from this machine. Use a dedicated environment, review and pin the biliup package if possible, avoid running installation as an administrator, and remember that biliup login creates local cookies that can keep the account usable for future uploads until revoked or removed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation
``` 2. Maintain a locked requirements file containing cryptographic hashes and install it with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Pin and review transitive dependencies through a reproducible lockfile or equivalent dependency-management process. 4. Document the expected official package index and package identity. Avoid untrusted mirrors or supplemental indexes that could enable dependency confusion. 5. Install the dependency in a dedicated virtual environment under a non-privileged account. 6. Review package updates before changing the pinned version, including provenance, release metadata, dependency changes, and published artifacts. 7. Correct the documentation stating that installation occurs automatically, or implement an explicit, reviewable installation mechanism with version and integrity verification. Automatic package installation at runtime should be avoided. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill claims 'automatic login' support, but the supplied content only instructs the user to run an interactive biliup login flow manually. This mismatch can mislead operators and downstream agents about what the skill actually automates, causing unsafe assumptions around authentication handling and cookie persistence.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · upload.py (reported line 32)May include surrounding context.

python
# Set UTF-8 encoding for Windows
    if os.name == 'nt':
        os.system('chcp 65001 > nul')
        os.environ['PYTHONIOENCODING'] = 'utf-8'
    
    print(f"Starting upload: {video_path}")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises shell and environment-dependent usage but does not declare any explicit tool scope or permissions boundary. In an agent setting, that omission can let the skill be invoked without clear user consent or policy checks for shell execution and environment manipulation, increasing the chance of unintended command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill does not prominently warn that it transmits local video files and associated metadata to a third-party service and stores authentication cookies locally for reuse. In a security-sensitive agent environment, missing disclosure can lead to accidental exfiltration of sensitive media or metadata and underestimation of the risk posed by persistent session artifacts.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · upload.py (reported line 48)May include surrounding context.

python
]
    
    try:
        result = subprocess.run(cmd, check=True)
        print("\n✅ Upload completed successfully!")
        print("Note: Video will be visible after Bilibili review.")
        return True

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The documentation presents partition names and example content in Chinese only, which imposes a locale-specific experience. For policy compliance, locale constraints should be explicitly documented and justified when a skill is tied to a region-specific platform.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.