bilibiliextractor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:27 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent Bilibili transcript purpose, but it asks agents to load local secrets unsafely, may upload audio to a third-party ASR service without clear user consent, and includes overbroad cleanup and dependency-install instructions.

Review before installing. Use only with Bilibili videos you are comfortable sending to Bilibili and, when subtitles are unavailable, to SiliconFlow for transcription. Avoid sourcing a broad .env file; provide only SILICONFLOW_API_KEY through a trusted secret mechanism. Do not let the agent run the wildcard cleanup command, and prefer preinstalled or pinned dependencies instead of runtime pip installation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:48

Finding

Arbitrary Shell Execution Through Environment File Sourcing

Content

View full analysis

注意：命令会自动尝试加载系统的 .env 文件获取真实密钥。你绝不能在命令中自行捏造或填写 `SILICONFLOW_API_KEY=sk-xxx` 这样的明文参数。 # 自动寻找并加载环境变量，然后使用相对路径执行脚本 if [ -f ~/.openclaw/.env ]; then source ~/.openclaw/.env; fi && PYTHONPATH=/tmp/pylibs python3 bilibili_extractor.py "<视频URL或BV号>" ``` The instructions later reinforce this behavior: ```text 执行命令模板中的 `source ~/.openclaw/.env` 会自动注入 Key。 ``` ### Technical Analysis The shell `source` command evaluates the entire contents of `~/.openclaw/.env` as executable shell syntax. The Skill only requires the value of `SILICONFLOW_API_KEY`, so evaluating arbitrary commands from the complete file exceeds the minimum privileges necessary. An environment file containing command substitutions, shell functions, redirections, or ordinary commands will execute them with the privileges of the Agent process. Sourcing the complete file can also export unrelated credentials to the Python child process, unnecessarily increasing the number of secrets available to the Skill and its dependencies. ### Attack Path 1. An attacker or compromised local process gains the ability to alter `~/.openclaw/.env`. 2. The attacker adds a shell command, command substitution, or malicious variable assignment to the file. 3. A user asks the Agent to invoke the Bilibili extraction Skill. 4. The Agent runs the documented command template. 5. `source ~/.openclaw/.env` evaluates the attacker's shell code before Python starts. 6. The injected command executes with all filesystem, network, and process privileges available to the Agent. ### Impact Assessment Successful exploitation provides arbitrary command execution under the Agent's operating-system identity. The attacker could read or modify files accessible to that account, access other secrets, initiate network connections, alter the workspac ...[truncated 173 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: bilibili_extractor.py:119

Finding

API Credential Is Required Before the Credential-Free Subtitle Path

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

**🚨 Agent 依赖安装约束**： > **绝对不要**在每次执行前主动安装依赖！ > 只有当你运行 `bilibili_extractor.py` 时明确遇到了 `ModuleNotFoundError: No module named 'requests'` 报错，你才被允许执行以下安装命令并重试： > `pip install requests --target=/tmp/pylibs` ``` The troubleshooting table repeats the same command: ```text | `ModuleNotFoundError: No module named 'requests'` | Agent 自行执行 `pip install requests --target=/tmp/pylibs` 然后重试。 | ``` ### Technical Analysis The installation command does not pin a reviewed version, verify package hashes, use a lock file, or identify a trusted immutable package source. It therefore installs whichever version and transitive dependencies the configured package index resolves at execution time. Python package installation and import can execute package-controlled code. Installing into the shared `/tmp/pylibs` location also creates a mutable import path that may be reused across Skill runs and potentially influenced by other local processes. ### Attack Path 1. The runtime does not have `requests` installed. 2. Execution raises `ModuleNotFoundError`. 3. Following the Skill instructions, the Agent invokes the unpinned `pip install` command. 4. The package resolver retrieves the current package and transitive dependencies from the configured index. 5. If the index, package account, dependency resolution, or network configuration is compromised, attacker-controlled package content is installed. 6. The subsequent retry imports code from `/tmp/pylibs`, executing the installed content with Agent privileges. No evidence was found that the named `requests` package is currently malicious; the vulnerability is the unsafe and mutable installation process. ### Impact Assessment A compromised dependency can execute arbitrary Python code with the permissions of the Agent, access env ...[truncated 204 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:124

Finding

Overbroad Wildcard Deletion of Temporary Audio Files

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tainted flow: 'headers' from os.environ.get (line 91, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · bilibili_extractor.py (reported line 106)May include surrounding context.

python

}
        
        try:
            response = requests.post(url, headers=headers, data=data, files=files)
            response.raise_for_status()
            result_json = response.json()
            return result_json.get("text", "")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

命令模板 (Agent 严格遵守)：

注意：命令会自动尝试加载系统的 .env 文件获取真实密钥。你绝不能在命令中自行捏造或填写 SILICONFLOW_API_KEY=sk-xxx 这样的明文参数。

bash

# 自动寻找并加载环境变量，然后使用相对路径执行脚本

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

命令模板 (Agent 严格遵守)：

注意：命令会自动尝试加载系统的 .env 文件获取真实密钥。你绝不能在命令中自行捏造或填写 SILICONFLOW_API_KEY=sk-xxx 这样的明文参数。

bash

# 自动寻找并加载环境变量，然后使用相对路径执行脚本

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The skill instructs the agent to run rm -f /tmp/tmp*.m4a to clean temporary files. Although narrower than a generic wildcard delete, it still authorizes destructive shell action based on a filename pattern in a shared temporary directory, which can delete unrelated files matching that pattern and is risky if executed automatically without validation.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

• ASR 转录完成后，必须删除临时音频文件（脚本已在 finally 块中处理）
• 如发现 /tmp 目录下有残留的 .m4a 文件，Agent 可通过命令清理：

bash

rm -f /tmp/tmp*.m4a

7. 输出格式

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The troubleshooting table repeats the instruction to execute rm -f /tmp/tmp*.m4a, reinforcing unsafe deletion guidance as an agent action. Repetition in error-handling paths increases the chance the command is used reflexively and without checking ownership or relevance of matching files.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md

| `[错误] 缺失硅基流动 API Key` | 告知用户："系统缺少 API 密钥，请检查 `~/.openclaw/.env` 配置文件中是否已正确写入 `SILICONFLOW_API_KEY`。" |
| 视频无字幕且音频流获取失败 | 告知用户无法提取，该视频可能已被删除或限制了访问权限。 |
| ASR 转录超时或脚本卡死 | 告知用户："提取耗时过长导致超时，这通常是因为视频较长且没有自带字幕。请尝试提取其他视频。" |
| 临时音频文件残留 | Agent 自行执行 `rm -f /tmp/tmp*.m4a` 进行清理。 |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill instructions, prompts, examples, and user-facing output templates are all defined in Chinese, and there is no indication that the user may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The workflow instructs the agent to source a local ~/.openclaw/.env file to load credentials, but it does not warn that this pulls secrets into the shell environment where downstream commands, logs, subprocesses, or accidental debugging output could expose them. While the command does not explicitly print the key, normalizing secret-loading from user-local files without privacy guidance increases the risk of credential disclosure and unsafe secret handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that when subtitles are unavailable it falls back to ASR using SiliconFlow, but it does not clearly warn that audio/content may be transmitted to an external third-party service. This can cause unintended disclosure of user-provided media or sensitive spoken content, especially when users expect only local processing.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · bilibili_extractor.py (reported line 30)May include surrounding context.

python

def get_video_info_and_cid(bvid):
    """获取视频基础信息和 CID"""
    api_url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
    response = requests.get(api_url, headers=BILI_HEADERS)
    data = response.json()
    if data['code'] == 0:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · bilibili_extractor.py (reported line 39)May include surrounding context.

python

def get_video_info_and_cid(bvid):
    """获取视频基础信息和 CID"""
    api_url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
    response = requests.get(api_url, headers=BILI_HEADERS)
    data = response.json()
    if data['code'] == 0:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · bilibili_extractor.py (reported line 61)May include surrounding context.

python

def get_video_info_and_cid(bvid):
    """获取视频基础信息和 CID"""
    api_url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}"
    response = requests.get(api_url, headers=BILI_HEADERS)
    data = response.json()
    if data['code'] == 0:

Tainted flow: 'sub_url' from requests.get (line 48, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 86% confidence

Finding

The subtitle URL is taken from Bilibili API response data and fetched without validating the destination host. If that upstream response is malicious or compromised, the code can be induced to make arbitrary outbound requests, creating an SSRF-style primitive and sending the Bilibili Referer header to unintended hosts. In this skill context the source is a trusted public API, which lowers likelihood, but the lack of allowlisting still makes it a real issue.

Content

Scanner excerpt · bilibili_extractor.py (reported line 50)May include surrounding context.

python

if not sub_url.startswith('http'):
                sub_url = 'https:' + sub_url
            
            sub_response = requests.get(sub_url, headers=BILI_HEADERS)
            sub_data = sub_response.json()
            
            full_text = " ".join([item['content'] for item in sub_data['body']])

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

When subtitles are unavailable, the skill downloads audio from Bilibili and uploads it to SiliconFlow for transcription, but it does not clearly warn the user that media content will be transmitted to a third-party processor. This creates a privacy and compliance risk, especially if the video contains sensitive, proprietary, or regulated content and the user expects only local processing.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This code sends audio content and an API credential to a third-party transcription service. In the context of a content-extraction skill, such transmission may be intended, but it still represents a real data-exposure boundary and becomes dangerous because the tool does not prominently disclose the transfer or obtain explicit consent before uploading user-selected content externally.

Content

Scanner excerpt · bilibili_extractor.py (reported line 89)May include surrounding context.

python

def convert_audio_to_text(audio_filepath):
    """调用硅基流动 (SiliconFlow) ASR 接口将音频转录为文本"""
    # 硅基流动标准的音频转写 API 端点
    url = "https://api.siliconflow.cn/v1/audio/transcriptions"
    
    headers = {
        "Authorization": f"Bearer {SILICONFLOW_API_KEY}"

Tainted flow: 'data' from requests.get (line 42, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · bilibili_extractor.py (reported line 106)May include surrounding context.

python

}
        
        try:
            response = requests.post(url, headers=headers, data=data, files=files)
            response.raise_for_status()
            result_json = response.json()
            return result_json.get("text", "")