Security audit

Check the latest videos and updates of Bilibili ups and see if they have updated today

Security checks for vulnerabilities and agentic risk

Overview

The skill does the advertised Bilibili update lookup, but it asks users to provide their full Bilibili browser cookies for a read-only viewer task without adequate scoping or warning.

Review before installing. Use only if you are comfortable giving the tool Bilibili session cookies; treat BILIBILI_COOKIES like an account credential, avoid pasting it into chats or logs, and clear or rotate it when done. Be aware that searches create a local user_cache.json with public uploader metadata, and dependency installation is not pinned.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: update_viewer.py:331
Finding: Excessive Collection and Propagation of the Complete Browser Cookie Set
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unbounded and Unverified Third-Party Dependency Installation
Content: View full analysis
=2.28.0 ``` The associated installation instruction at `SKILL.md:14-18` is: ```bash pip install -r {baseDir}/requirements.txt ``` ### Technical Analysis The dependency specification provides only a minimum version and no upper bound, exact version, lockfile, or package integrity hash. As a result, installation may resolve to any future `requests` release satisfying `>=2.28.0`, along with whatever transitive dependencies that release declares. This makes installation non-reproducible and prevents the audited source tree from uniquely determining which third-party code will be installed. A future compromised, malicious, or incompatible package release could therefore enter the runtime without a corresponding review of this Skill. The dependency name is the legitimate `requests` package, and the audit found no evidence of typosquatting, dependency confusion, a custom package index, or a currently malicious dependency. The finding concerns the unsafe breadth and lack of integrity verification in the installation policy. ### Attack Path 1. A user follows the Skill setup instructions and runs `pip install -r requirements.txt`. 2. The package resolver queries its configured package index for a version of `requests` satisfying `>=2.28.0`. 3. The resolver may select a future version and future transitive dependency versions that were not reviewed during this audit. 4. Package installation executes package build or installation behavior where applicable. 5. The selected packages are imported into the Skill's Python process at runtime. 6. If a resolved package or transitive dependency is compromised, its code can execute with the privileges of the user running the instal ...[truncated 569 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 12)May include surrounding context.
text
.venv/ # 包含敏感信息的文件 .env *.env # 用户搜索缓存

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 13)May include surrounding context.
text
.venv/ # 包含敏感信息的文件 .env *.env # 用户搜索缓存

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose understates important behaviors: username-based search, persistent local caching, and use of Bilibili cookies as authentication material. This mismatch can mislead users and reviewers about data handling and privilege needs, increasing the chance that sensitive credentials are provided without informed consent and that local data persistence occurs unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs users to export full Bilibili cookies, which are highly sensitive session credentials that may allow account access, impersonation, or disclosure of private account data if mishandled. The guidance does not adequately warn users about the sensitivity of these tokens, their scope, storage risk, or safer alternatives, making credential theft or accidental leakage more likely.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes Python scripts, requires environment variables containing credentials, performs network access to Bilibili APIs, and is described as using local cache files, yet it declares no explicit tool scope or permission boundaries. This weakens sandboxing and user visibility, making it easier for a skill with credential and filesystem access to overreach beyond its stated purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: L03 将“B站、UP主、视频更新、今天更新了吗、最新视频、最新动态、查看UP主”都作为触发词，其中“最新视频”“最新动态”“今天更新了吗”等短语过于通用，缺少上下文限定，容易在普通对话中与非本技能请求重叠。该描述也没有提供排除条件或负面示例来界定何时不应激活技能。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The client accepts raw authenticated Bilibili cookies and automatically attaches them to all requests without any visible warning, minimization, or consent flow. If users provide active session cookies, the skill can perform authenticated requests and access account-scoped data, creating a privacy and account-security risk if the cookies are over-collected, mishandled, or reused outside the user's expectation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · bilibili_api.py (reported line 84)May include surrounding context.
python
if self._img_key and self._sub_key: return self._img_key, self._sub_key resp = self.session.get("https://api.bilibili.com/x/web-interface/nav") data = resp.json() if data["code"] != 0:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · bilibili_api.py (reported line 130)May include surrounding context.
python
if self._img_key and self._sub_key: return self._img_key, self._sub_key resp = self.session.get("https://api.bilibili.com/x/web-interface/nav") data = resp.json() if data["code"] != 0:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · bilibili_api.py (reported line 163)May include surrounding context.
python
if self._img_key and self._sub_key: return self._img_key, self._sub_key resp = self.session.get("https://api.bilibili.com/x/web-interface/nav") data = resp.json() if data["code"] != 0:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · bilibili_api.py (reported line 262)May include surrounding context.
python
if self._img_key and self._sub_key: return self._img_key, self._sub_key resp = self.session.get("https://api.bilibili.com/x/web-interface/nav") data = resp.json() if data["code"] != 0:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · bilibili_api.py (reported line 283)May include surrounding context.
python
if self._img_key and self._sub_key: return self._img_key, self._sub_key resp = self.session.get("https://api.bilibili.com/x/web-interface/nav") data = resp.json() if data["code"] != 0:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · bilibili_api.py (reported line 313)May include surrounding context.
python
if self._img_key and self._sub_key: return self._img_key, self._sub_key resp = self.session.get("https://api.bilibili.com/x/web-interface/nav") data = resp.json() if data["code"] != 0:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · bilibili_api.py (reported line 339)May include surrounding context.
python
if self._img_key and self._sub_key: return self._img_key, self._sub_key resp = self.session.get("https://api.bilibili.com/x/web-interface/nav") data = resp.json() if data["code"] != 0:

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill includes subtitle enumeration, download, and text extraction capabilities that exceed the stated purpose of checking whether a B站 UP主 has recent videos or dynamics. This unnecessary scope expansion increases data access and external request surface, and could expose or process more user/content data than users would reasonably expect from the manifest.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill requires raw Bilibili cookies from the environment to perform a viewer-style task, which introduces handling of session credentials far beyond what users would expect from simply checking an uploader's latest content. Even if the code does not obviously exfiltrate the cookies, collecting authenticated session material increases the blast radius if logs, subprocesses, dependent libraries, or future modifications expose them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Requesting sensitive cookie credentials through an environment variable without meaningful disclosure can mislead users into supplying full authenticated session data for a low-risk viewer task. This creates avoidable privacy and account-security risk because users may not realize the credential sensitivity or how broadly those cookies may authorize actions outside this script's stated purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The display name is written specifically in Chinese ("B站 (bilibili) 更新查看") with no indication that the skill supports other languages or that the locale restriction is intentional and documented. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The method get_video_subtitle_text sets prefer_lang to "zh" by default and the comments explicitly state a preference for Chinese subtitles. This imposes a language default in natural-language behavior without offering an explicit user choice or documenting an opt-in mechanism.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency specification uses a lower-bound only constraint (requests>=2.28.0), which makes builds non-reproducible and can pull in unexpected future releases with breaking changes or newly introduced security issues. In a security context, unpinned dependencies also make it impossible to verify exactly which version will be installed and whether known advisories apply.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: Because requests is not pinned, the manifest does not establish whether installation will use a version affected by one of the known advisories associated with this package. This uncertainty is a supply-chain risk: depending on resolution time and environment, the skill may install a vulnerable release and expose consumers to issues such as credential leakage or TLS/request-validation flaws present in some historical versions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The stated skill purpose is to view a Bilibili uploader's latest content and check whether they updated today. In addition to that, the code creates and maintains a local JSON cache of search results and supports fuzzy user lookup, which is extra behavior not mentioned in the manifest description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script persistently writes searched user/profile data to a local JSON cache without clear user notice or consent. While the cached fields appear to be public-facing metadata rather than secrets, undisclosed local persistence can still create privacy, transparency, and data-retention concerns in shared or managed environments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.