Security audit

Bilibili Video Downloader

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Bilibili downloader that calls yige.zone with a user API key and video URL; its main risks are privacy, credential handling, and lawful-use considerations rather than hidden malicious behavior.

Install only if you are comfortable sending Bilibili URLs and your YIGE_API_KEY to yige.zone. Use it only for videos you own or are authorized to download, and prefer an environment variable or secure secret handling over pasting keys into prompts or logs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill documentation describes use of an external API key and third-party service, but it does not declare the permissions implied by environment access, filesystem access, networking, and possible shell execution. This creates a transparency and least-privilege problem: users may authorize or install a seemingly simple downloader without understanding that credentials may be read and persisted locally and that external requests are required.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The stated behavior is simple Bilibili link parsing, but the detected behavior includes credential storage, reading local configuration, sending user-supplied links to a third-party service, and returning extra data beyond the narrow user expectation. That mismatch is dangerous because it undermines informed consent and can expose secrets, user activity, or metadata to a service the user did not realize was involved.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The invocation guidance encourages very broad natural-language triggering such as 'help me save this Bilibili video' or 'download this viral video for me' without clear user-intent boundaries, confirmation requirements, or policy guardrails. In a skill that facilitates retrieval of watermark-free direct download links, this increases the chance of accidental activation and use for copyright-infringing or policy-violating downloads.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README promotes obtaining 'watermark-free' direct download links and permanent local copies, but omits any warning about copyright, creator consent, or Bilibili platform terms. In this context, the absence of legal/policy warnings materially increases misuse risk because the skill is specifically positioned to bypass normal viewing flows and facilitate unauthorized retention or redistribution.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger examples are broad, conversational phrases such as '帮我把这条B站视频存下来' and '下载这条B站视频', which can overlap with normal user conversation and cause the skill to activate without a clearly bounded command surface. In a skill that performs third-party video parsing/downloading, accidental activation increases the chance of unintentional use for copyright-sensitive content and can route user data or links to an external service unexpectedly.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README promotes downloading and permanently retaining third-party Bilibili videos, including '无水印' and '永久留存', but does not warn users about copyright, terms-of-service, or authorization requirements. In this context, the omission materially increases misuse risk because the skill is specifically designed to obtain direct download links for protected platform content, making non-compliant use more likely.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The markdown says the service uses yige.zone for parsing, but it does not clearly warn users that pasted video links are transmitted to a third-party processor. Even if the links are not highly sensitive by themselves, they can reveal private interests, unpublished URLs, or operational research targets, so omission of that warning weakens privacy expectations and informed consent.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The instructions tell users to export an API key but do not warn that this credential is sensitive or describe safe handling practices. Poor credential guidance increases the chance of accidental leakage through shell history, screenshots, shared terminals, dotfiles, or insecure local storage.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow explicitly sends user-supplied Bilibili URLs and an API key to a third-party service, but the skill text does not require any user-facing notice or consent about this external data transmission. This is risky because user activity, target URLs, and credentials may be disclosed to an external operator without informed user awareness, which can violate privacy expectations and increase credential-handling risk.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill transmits user-supplied Bilibili URLs and the user's API credential to an external service at yige.zone, but the user-facing behavior shown here does not provide an explicit warning or consent step about third-party data transmission. This creates privacy and trust risks because URLs may contain sensitive watch history, private tokens, or identifying query parameters, and users may not expect their inputs to leave the local environment.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.