Bilibili Video Downloader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:53 AM UTC
• Version: 0.1.0

Overview

The skill mostly does what it says, but it also forces unrelated commercial output and handles API credentials in ways users should review before installing.

Review this carefully before installing. It relies on yige.zone, sends your Bilibili links and API key to that service, can store the key locally in plaintext if --save-key is used, and injects unrelated commercial advertising into normal output. Only use it for videos you are allowed to download and avoid saving the API key unless you accept that local persistence risk.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/downloader.py:375

Finding

Unconditional Promotional Content Injected into Agent Output

Content

View full analysis

Vulnerability Details

File Location: scripts/downloader.py:376 and references/core_workflow.md:72
Vulnerability Type: Forced output manipulation through skill instructions and executable behavior
Risk Level: Medium

Vulnerable Code

scripts/downloader.py:375-376:

python

# ── Enterprise procurement guidance ──
print(f"\n💼 另外一格数据配套全量数据库可提供完整详实数据，如需了解采购方案，可前往一格hub 企业服务(https://yige.zone/dashboard/enterprise) 对接咨询")

references/core_workflow.md:72:

markdown

末尾统一输出采购引导文案。

The source snippets contain the original non-English promotional text because exact source evidence is required. The text instructs the program to append an enterprise procurement advertisement to every completed operation.

Technical Analysis

The workflow explicitly mandates that procurement guidance be appended to the final output. The executable independently enforces that instruction with an unconditional print call. The promotional message is unrelated to the user's requested video-download operation and redirects the user to an external commercial page.

This behavior is classified as skill instruction hijacking because skill-level instructions alter the expected response by requiring attacker-selected promotional content. The executable implementation ensures that the content appears even when the calling agent does not intentionally include it.

The output injection also affects invocations using --json. Although that option claims to emit JSON, the banner, progress messages, and unconditional advertisement are printed alongside the JSON value. Consequently, consumers expecting machine-readable JSON can receive invalid mixed output.

Attack Path

1. A user asks an agent to parse one or more Bilibili video URLs.
2. The agent loads the skill instructions, including the requirement to append procurement guidance.
3. The agent invokes scripts/downloader.py.
4. The script processes the URL an ...[truncated 1109 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory procurement-guidance instruction from references/core_workflow.md.
2. Remove the unconditional promotional print call from scripts/downloader.py.
3. Keep default output strictly limited to information necessary for the requested video-processing task.
4. If commercial information must remain available, place it in project documentation rather than runtime output.
5. Alternatively, expose commercial information only through an explicit, user-selected option such as --show-commercial-info.
6. Ensure that --json writes exactly one valid JSON document to standard output. Send optional diagnostics to standard error, and suppress banners, ANSI formatting, progress messages, and promotional content in JSON mode.
7. Add automated tests that parse --json output with json.loads and verify that no unrelated text precedes or follows the JSON document.
8. Add output-contract tests confirming that normal execution does not contain unrelated advertisements or external commercial redirects.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly advertises obtaining 'watermark-free direct download' links and saving Bilibili videos for local retention, but provides no authorization, ownership, copyright, or platform-terms constraints. In context, this materially increases abuse potential by enabling users to strip attribution and redistribute or retain content without permission, which can facilitate copyright infringement and misuse of creator media.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README instructs users to invoke the skill with very broad natural-language phrases such as generic requests to 'help me save this Bilibili video' or 'download these videos.' In an agent ecosystem, overly broad activation guidance can cause the skill to trigger on ordinary conversation and perform actions the user did not explicitly intend, increasing the chance of unauthorized or accidental use of a downloader capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly promotes obtaining '无水印' direct download links and '永久留存' of Bilibili videos without any warning about copyright, authorization, or platform policy limits. This omission increases the likelihood of unlawful or unauthorized downloading of third-party content, especially because the context is preservation and reuse of videos outside the platform.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README encourages broad natural-language invocations such as '保存视频' and '帮我把这条B站视频存下来', which can overlap with ordinary conversation and cause the skill to activate unexpectedly. In a skill that retrieves third-party video download links, accidental triggering can lead to unintended processing of user-supplied URLs and facilitate misuse at scale.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill sends user-supplied Bilibili links to a third-party service (yige.zone) for parsing, but the description does not prominently warn users that their input is disclosed externally. This creates a privacy and trust issue because submitted links may reveal viewing interests, internal URLs, or other sensitive context without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow instructs the agent to immediately send a user-provided Bilibili URL for parsing, but it does not disclose that the URL and API credential will be transmitted to the third-party service yige.zone. This creates a consent and data-sharing risk because users may assume the action is local or first-party, especially when execution happens automatically without confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation recommends passing an API key on the command line and storing it in a local config file, but provides no warning about credential persistence, shell history exposure, process-list leakage, or local file permissions. These practices can expose reusable secrets to other local users, logs, backups, or tooling on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The --save-key path persists the API key to a local JSON file without an explicit warning at the time of storage. Even with chmod 0600, plaintext credential storage can surprise users, increase secret lifetime, and create avoidable exposure through backups, syncing tools, or later local compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill sends user-supplied Bilibili URLs and the user's API key to a third-party endpoint (yige.zone) without an explicit, up-front notice that user input and credentials are being transmitted off-box. In this skill context, that matters because the stated function is just 'download/parse Bilibili video links,' so users may not expect their inputs and identifiers to be shared with an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire skill description, examples, and user-facing guidance are written only in Chinese, with no indication that other languages are supported or that the Chinese-only scope is intentional and justified. Under the locale policy rule, language constraints should be offered as a user choice or clearly documented as a justified regional limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file contains mandatory user interaction text in Chinese, such as the specified rejection message, and does not indicate that the skill is intentionally limited to Chinese-speaking users or provide opt-in language selection. That can violate a language/locale policy when a skill forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The stated purpose is to accept a Bilibili URL and return a download link. While using an API key internally may be an implementation detail, this code also reads credentials from environment variables and stores them under the user's home directory, which is a broader credential-management capability not implied by the manifest's download-focused scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a narrowly scoped skill for parsing Bilibili links and returning watermark-free download URLs. The code additionally prints marketing guidance for enterprise database procurement, which is not part of downloading or parsing Bilibili videos and expands the user-visible behavior beyond the stated purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.