ClawHub
Back to skill

Security audit

Bilibili Comment

Security checks across malware telemetry and agentic risk

Overview

This skill coherently fetches Bilibili comments through a disclosed third-party API and creates local HTML reports, with some usability and consent notes but no artifact-backed malicious behavior.

Install only if you are comfortable sending Bilibili video IDs and receiving public comment data through yige.zone using your YIGE_API_KEY. Expect report files under ~/Downloads/QoderReports by default, and be aware the workflow can open the generated HTML report locally after confirmation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill documentation describes capabilities that include environment variable access, local file read/write, and outbound network access, but it does not declare any permissions or constraints for those operations. This creates a transparency and least-privilege problem: an agent may invoke a skill with broader runtime access than users or reviewers expect, increasing the chance of unintended data exposure or unsafe file/network actions.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The README explicitly says users can invoke the skill with arbitrary natural language and '无需记忆固定命令', which makes activation boundaries ambiguous. In an agent environment, broad trigger semantics increase the chance of unintended invocation from ordinary conversation or from attacker-controlled content that mentions B站 comments, leading to unplanned external API use and data retrieval.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The example phrase '看看这个视频的评论怎么样' is common conversational language and can easily appear in benign discussion, making accidental or adversarial triggering more likely. Because the skill performs network-backed comment retrieval and analysis, weak activation specificity can let unrelated context, quoted text, or prompt-injected content cause unintended tool execution.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger list contains broad phrases such as '看评论' and general references to comment analysis that could match ordinary conversation rather than a clear request to run this specific skill. Overly broad activation increases the risk of accidental invocation, which may lead to unnecessary network requests, file generation, or use of configured API credentials without strong user intent.

Missing User Warnings

Low
Confidence
93% confidence
Finding
The workflow directs the agent to create a local JSON file containing analysis data, but it does not require notifying the user or obtaining consent before writing to disk. Silent file creation is risky because it can surprise users, leave residual data on the system, and normalize unauthorized filesystem side effects even if the content is not highly sensitive here.

Missing User Warnings

Low
Confidence
97% confidence
Finding
The workflow instructs the agent to automatically launch the generated HTML report with the local system opener, without an explicit warning or confirmation. Automatically opening local files can trigger browser or application execution unexpectedly, alter user context, and increase risk if the generated HTML contains unsafe active content or if the path is manipulated elsewhere in the skill.

Unbounded Output

Medium
Category
Output Handling
Content
### Highlights

- **Bilibili meme culture understanding**: Recognizes awsl / yyds / xswl / 爷青回 / 下次一定 and other barrage slang in their real context
- **Complete data display**: Work details (views / likes / coins / favorites / danmaku, etc.) and full comment table — no truncation
- **Encoding-safe backfill**: Intelligent encoding ensures Chinese analysis content is injected into reports without corruption

---
Confidence
88% confidence
Finding
no truncation

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/bili_comment_search.py:36