B站 (bilibili) 热门视频监控

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:59 AM UTC
• Version: 1.0.21

Overview

The skill appears to do the advertised Bilibili report and email workflow, but it asks for powerful account and email credentials and can store them in plaintext locally.

Review carefully before installing. Use a dedicated or low-risk Bilibili account and Gmail app password if possible, prefer environment variables over command-line secrets, avoid keeping plaintext bilibili-monitor.json longer than needed, and confirm both the report contents and recipient list before sending email.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to read and write local files, access environment variables or secrets-equivalent inputs, and perform network operations, yet it declares no permissions. This creates a transparency and consent failure: users and policy engines cannot accurately assess that the skill will store credentials locally, contact external services, and send email on the user's behalf.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared description says the skill generates a Bilibili daily report and sends email, but the actual behavior is materially broader: it collects full Bilibili cookies, extracts subtitles, sends content to a third-party AI provider, converts content to HTML email, and performs authenticated outbound email delivery. This mismatch can mislead users into granting sensitive credentials and content access they did not reasonably expect from the short description.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill implements subtitle enumeration, download, and conversion to plain text even though the manifest only describes generating a hot-video daily report. This expands data collection from public ranking metadata into full video transcript content, which can materially increase privacy, copyright, and scope-of-use risk if users are unaware that transcript content is being fetched and processed.

Description-Behavior Mismatch

Low

• Confidence: 82% confidence
• Finding: The code fetches AI-generated video summaries from Bilibili despite the skill description only mentioning a hot-video daily report. While less invasive than full subtitle download, this still broadens capability beyond the stated purpose and may cause undisclosed collection or downstream transmission of derived content.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file's behavior does not match the declared skill purpose: instead of generating and emailing a Bilibili hot-video daily report, it fetches subtitles for an arbitrary video URL and can request a user's SESSDATA login cookie. This mismatch is dangerous because hidden or off-manifest functionality can be used to collect sensitive credentials or perform unexpected data access outside the user's intended workflow.

Description-Behavior Mismatch

Medium

• Confidence: 76% confidence
• Finding: The skill description says it generates a Bilibili hot-video daily report, but the code additionally performs subtitle extraction and sends full subtitle content to an external LLM for deeper analysis. That materially expands data handling and third-party disclosure beyond what a user would reasonably infer from the manifest, increasing privacy and supply-chain risk.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger phrases include very generic terms such as “热门视频” and “视频日报”, which can plausibly appear in normal user conversation and cause unintended skill activation. In an agent context, accidental invocation can lead to unnecessary network access, use of local credentials, external LLM calls, and possible email sending without the user intending this specific skill.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The README states that the skill fetches subtitles, sends content to OpenRouter LLMs, and can send email, but it does not clearly warn users that third-party services may receive video-derived content and that email delivery can expose generated reports to recipients. In an agent skill, this omission is security-relevant because users may not realize that invocation can transmit data off-device using configured credentials.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases include broad generic terms such as '热门视频' and '视频日报', which can overlap with ordinary conversation and unrelated requests. That raises the risk of accidental invocation of a skill that collects credentials, performs network actions, and may send outbound email, making unintended execution more dangerous than for a read-only skill.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill asks for highly sensitive secrets including full Bilibili cookies, an OpenRouter API key, a Gmail address, and a Gmail app password, then writes them into a local JSON file in plaintext. Although it mentions local-only storage and .gitignore, it does not clearly warn about plaintext-at-rest risk, local compromise, backups, shell history exposure, or the possibility that these credentials could be reused to access accounts and send email.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Subtitle text derived from videos is sent to OpenRouter without an explicit disclosure at the point of transmission or a clear consent gate. Users may expect local report generation, but the code forwards potentially large and content-rich transcript data to a third-party service, creating privacy, compliance, and confidentiality concerns.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sends video metadata and generated summaries to an external LLM service without explicit user disclosure. Even if the source is public video data, combining metadata with prior model output and transmitting it off-platform expands data exposure in ways not clearly communicated to the operator.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Accepting SMTP credentials via command-line arguments can expose secrets through process listings, shell history, job control logs, or orchestration metadata visible to other local users or administrators. In this skill, the password is a real mail account credential, so leakage could enable unauthorized email access or abuse of the sender account.

Ssd 1

Medium

• Confidence: 93% confidence
• Finding: Untrusted subtitle text is interpolated directly into the LLM prompt, allowing prompt injection from video content to influence model behavior and output. A crafted subtitle could instruct the model to ignore formatting rules, emit misleading content, or manipulate downstream report text, undermining report integrity and potentially causing unsafe downstream actions if the report is reused elsewhere.

Ssd 1

Medium

• Confidence: 92% confidence
• Finding: The second prompt embeds untrusted video title and prior AI summary verbatim, so prompt injection can propagate from metadata or the first model's output into the next LLM call. This creates a multi-stage injection chain where malicious or adversarial content can bias commentary generation, reduce reliability, and contaminate the final report.

External Transmission

Medium

• Category: Data Exfiltration

Content

def get_subtitle_info(aid: int, cid: int, sessdata: str = "") -> list:
    """获取字幕信息"""
    url = f"https://api.bilibili.com/x/player/wbi/v2?aid={aid}&cid={cid}"

    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",

• Confidence: 72% confidence
• Finding: https://api.bilibili.com/

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0

• Confidence: 98% confidence
• Finding: requests>=2.28.0

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.