Check the latest videos and updates of Bilibili ups and see if they have updated today

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:23 PM UTC
• Version: 1.0.0

Overview

The skill does the advertised Bilibili update lookup, but it asks users to provide their full Bilibili browser cookies for a read-only viewer task without adequate scoping or warning.

Review before installing. Use only if you are comfortable giving the tool Bilibili session cookies; treat BILIBILI_COOKIES like an account credential, avoid pasting it into chats or logs, and clear or rotate it when done. Be aware that searches create a local user_cache.json with public uploader metadata, and dependency installation is not pinned.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: update_viewer.py:331
• Finding: Excessive Collection and Propagation of the Complete Browser Cookie Set<![CDATA[ ## Vulnerability Details **File Location**: `update_viewer.py:331-344`; related cookie scoping occurs at `bilibili_api.py:49-53`, and full-cookie collection is instructed at `SKILL.md:22-27` **Vulnerability Type**: Excessive credential handling and insufficient least-privilege controls **Risk Level**: Medium ### Complete Code Snippet `update_viewer.py:331-344`: ```python # 获取 cookies cookies_str = os.environ.get('BILIBILI_COOKIES', '') if not cookies_str: print("错误：必须提供 --cookies 参数或设置 BILIBILII_COOKIES 环境变量") print("\n获取方法：") print(" 1. 登录 B站") print(" 2. F12 打开开发者工具 → Network 选项卡") print(" 3. 刷新页面，找到任意请求") print(" 4. 复制 Request Headers 中的 Cookie 值") sys.exit(1) # 解析 cookies all_cookies = parse_cookies(cookies_str) # 创建 API 客户端 api = BilibiliAPI(all_cookies=all_cookies) ``` The corresponding cookie propagation logic appears at `bilibili_api.py:49-53`: ```python # 如果提供了全部 cookies，直接设置 if all_cookies: for key, value in all_cookies.items(): self.session.cookies.set(key, value, domain=".bilibili.com") ``` The documented collection instruction appears at `SKILL.md:22-27`: ```bash export BILIBILI_COOKIES="你的B站cookies" ``` ### Technical Analysis The Skill directs the user to copy the complete Cookie header from an authenticated Bilibili browser session. The application parses every supplied cookie without maintaining an allowlist of required cookie names, then adds all parsed values to a shared `requests.Session`. Each cookie is explicitly scoped to `.bilibili.com`, making it eligible for transmission to applicable Bilibili subdomains. Consequently, sensitive authentication or account-state cookies unrelated to the requested read-only operation may be propagated with API requests. This violates the principle of least privilege. The Skill only needs enough state to query creator information, videos, dynamics, or sear ...[truncated 2038 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Define an explicit allowlist containing only cookie names proven necessary for the supported API operations. 2. Discard or reject all unrecognized cookie names rather than loading the complete browser Cookie header. 3. Permit anonymous requests for endpoints that do not require authentication. 4. Request individual cookie values instead of instructing users to copy an entire browser Cookie header. 5. Scope cookies to the narrowest required host rather than `.bilibili.com` whenever the API permits it. 6. Use separate sessions for authenticated and anonymous operations to prevent accidental credential propagation. 7. Never print, log, cache, or include cookie values in exception diagnostics. 8. Document the precise permissions and account effects of every requested credential. 9. Add tests that inspect prepared requests and verify that only approved cookie names are attached to each destination. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Unbounded and Unverified Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1`; installation is instructed at `SKILL.md:14-18` **Vulnerability Type**: Unpinned dependency and non-reproducible supply-chain resolution **Risk Level**: Low ### Complete Code Snippet `requirements.txt:1`: ```text requests>=2.28.0 ``` The associated installation instruction at `SKILL.md:14-18` is: ```bash pip install -r {baseDir}/requirements.txt ``` ### Technical Analysis The dependency specification provides only a minimum version and no upper bound, exact version, lockfile, or package integrity hash. As a result, installation may resolve to any future `requests` release satisfying `>=2.28.0`, along with whatever transitive dependencies that release declares. This makes installation non-reproducible and prevents the audited source tree from uniquely determining which third-party code will be installed. A future compromised, malicious, or incompatible package release could therefore enter the runtime without a corresponding review of this Skill. The dependency name is the legitimate `requests` package, and the audit found no evidence of typosquatting, dependency confusion, a custom package index, or a currently malicious dependency. The finding concerns the unsafe breadth and lack of integrity verification in the installation policy. ### Attack Path 1. A user follows the Skill setup instructions and runs `pip install -r requirements.txt`. 2. The package resolver queries its configured package index for a version of `requests` satisfying `>=2.28.0`. 3. The resolver may select a future version and future transitive dependency versions that were not reviewed during this audit. 4. Package installation executes package build or installation behavior where applicable. 5. The selected packages are imported into the Skill's Python process at runtime. 6. If a resolved package or transitive dependency is compromised, its code can execute with the privileges of the user running the instal ...[truncated 569 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `requests` to an exact reviewed version rather than using an unrestricted minimum version. 2. Generate and commit a dependency lockfile that includes all transitive dependencies. 3. Record cryptographic hashes and install with pip's `--require-hashes` option. 4. Use a trusted, explicitly configured package index and disable unexpected fallback indexes. 5. Review dependency updates through an automated pull-request and security-testing process. 6. Run dependency vulnerability scanning in continuous integration. 7. Install dependencies inside an isolated virtual environment with ordinary user privileges. 8. Regularly update the pinned dependency after reviewing security advisories, rather than leaving it permanently outdated. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Credential Access

High

• Category: Privilege Escalation

Content

.venv/

# 包含敏感信息的文件
.env
*.env

# 用户搜索缓存

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

.venv/

# 包含敏感信息的文件
.env
*.env

# 用户搜索缓存

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose understates important behaviors: username-based search, persistent local caching, and use of Bilibili cookies as authentication material. This mismatch can mislead users and reviewers about data handling and privilege needs, increasing the chance that sensitive credentials are provided without informed consent and that local data persistence occurs unexpectedly.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill instructs users to export full Bilibili cookies, which are highly sensitive session credentials that may allow account access, impersonation, or disclosure of private account data if mishandled. The guidance does not adequately warn users about the sensitivity of these tokens, their scope, storage risk, or safer alternatives, making credential theft or accidental leakage more likely.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill invokes Python scripts, requires environment variables containing credentials, performs network access to Bilibili APIs, and is described as using local cache files, yet it declares no explicit tool scope or permission boundaries. This weakens sandboxing and user visibility, making it easier for a skill with credential and filesystem access to overreach beyond its stated purpose.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: L03 将“B站、UP主、视频更新、今天更新了吗、最新视频、最新动态、查看UP主”都作为触发词，其中“最新视频”“最新动态”“今天更新了吗”等短语过于通用，缺少上下文限定，容易在普通对话中与非本技能请求重叠。该描述也没有提供排除条件或负面示例来界定何时不应激活技能。

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The client accepts raw authenticated Bilibili cookies and automatically attaches them to all requests without any visible warning, minimization, or consent flow. If users provide active session cookies, the skill can perform authenticated requests and access account-scoped data, creating a privacy and account-security risk if the cookies are over-collected, mishandled, or reused outside the user's expectation.

External Transmission

Medium

• Category: Data Exfiltration

Content

if self._img_key and self._sub_key:
            return self._img_key, self._sub_key

        resp = self.session.get("https://api.bilibili.com/x/web-interface/nav")
        data = resp.json()

        if data["code"] != 0:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

if self._img_key and self._sub_key:
            return self._img_key, self._sub_key

        resp = self.session.get("https://api.bilibili.com/x/web-interface/nav")
        data = resp.json()

        if data["code"] != 0:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

if self._img_key and self._sub_key:
            return self._img_key, self._sub_key

        resp = self.session.get("https://api.bilibili.com/x/web-interface/nav")
        data = resp.json()

        if data["code"] != 0:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

if self._img_key and self._sub_key:
            return self._img_key, self._sub_key

        resp = self.session.get("https://api.bilibili.com/x/web-interface/nav")
        data = resp.json()

        if data["code"] != 0:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

if self._img_key and self._sub_key:
            return self._img_key, self._sub_key

        resp = self.session.get("https://api.bilibili.com/x/web-interface/nav")
        data = resp.json()

        if data["code"] != 0:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

if self._img_key and self._sub_key:
            return self._img_key, self._sub_key

        resp = self.session.get("https://api.bilibili.com/x/web-interface/nav")
        data = resp.json()

        if data["code"] != 0:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

if self._img_key and self._sub_key:
            return self._img_key, self._sub_key

        resp = self.session.get("https://api.bilibili.com/x/web-interface/nav")
        data = resp.json()

        if data["code"] != 0:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill includes subtitle enumeration, download, and text extraction capabilities that exceed the stated purpose of checking whether a B站 UP主 has recent videos or dynamics. This unnecessary scope expansion increases data access and external request surface, and could expose or process more user/content data than users would reasonably expect from the manifest.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill requires raw Bilibili cookies from the environment to perform a viewer-style task, which introduces handling of session credentials far beyond what users would expect from simply checking an uploader's latest content. Even if the code does not obviously exfiltrate the cookies, collecting authenticated session material increases the blast radius if logs, subprocesses, dependent libraries, or future modifications expose them.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Requesting sensitive cookie credentials through an environment variable without meaningful disclosure can mislead users into supplying full authenticated session data for a low-risk viewer task. This creates avoidable privacy and account-security risk because users may not realize the credential sensitivity or how broadly those cookies may authorize actions outside this script's stated purpose.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The display name is written specifically in Chinese ("B站 (bilibili) 更新查看") with no indication that the skill supports other languages or that the locale restriction is intentional and documented. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The method get_video_subtitle_text sets prefer_lang to "zh" by default and the comments explicitly state a preference for Chinese subtitles. This imposes a language default in natural-language behavior without offering an explicit user choice or documenting an opt-in mechanism.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0

• Confidence: 94% confidence
• Finding: The dependency specification uses a lower-bound only constraint (`requests>=2.28.0`), which makes builds non-reproducible and can pull in unexpected future releases with breaking changes or newly introduced security issues. In a security context, unpinned dependencies also make it impossible to verify exactly which version will be installed and whether known advisories apply.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: Because `requests` is not pinned, the manifest does not establish whether installation will use a version affected by one of the known advisories associated with this package. This uncertainty is a supply-chain risk: depending on resolution time and environment, the skill may install a vulnerable release and expose consumers to issues such as credential leakage or TLS/request-validation flaws present in some historical versions.

Description-Behavior Mismatch

Low

• Confidence: 80% confidence
• Finding: The stated skill purpose is to view a Bilibili uploader's latest content and check whether they updated today. In addition to that, the code creates and maintains a local JSON cache of search results and supports fuzzy user lookup, which is extra behavior not mentioned in the manifest description.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script persistently writes searched user/profile data to a local JSON cache without clear user notice or consent. While the cached fields appear to be public-facing metadata rather than secrets, undisclosed local persistence can still create privacy, transparency, and data-retention concerns in shared or managed environments.

Static analysis

No suspicious patterns detected.