ClawHub
Back to skill

Security audit

Bilibili Garb

Security checks for vulnerabilities and agentic risk

Overview

The skill is useful for Bilibili garb lookup, but it asks users to capture and store live account credentials in ways that create meaningful account-risk exposure.

Install only if you are comfortable giving the skill access to your Bilibili account session. Do not use packet capture or browser cookies casually, do not commit configs/bili-api-creds.json, store any credentials outside shared workspaces with strict permissions, rotate them after use, and avoid running debug or curl examples where logs are retained.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/bilibili-garb-collection.sh:214
Finding

Bilibili access token exposed through the curl process command line

Content
View full analysis

Vulnerability Details

File Location: scripts/bilibili-garb-collection.sh:214
Vulnerability Type: Authentication token disclosure through process arguments
Risk Level: Medium

Vulnerable Code:

bash
LOTTERY_RESPONSE=$(curl -s "https://api.bilibili.com/x/vas/dlc_act/lottery_home_detail?act_id=${ID}&lottery_id=${LOTTERY_ID}&mobi_app=iphone&platform=ios&appkey=${APPKEY}&access_key=${ACCESS_KEY}" 2>/dev/null)

Technical Analysis

The script interpolates BILI_ACCESS_KEY into a URL passed directly as a command-line argument to curl. Although the request uses HTTPS and targets an official Bilibili endpoint, TLS only protects the request in transit. It does not conceal the command arguments on the local system.

During execution, the complete URL—including the access token—may be exposed through process inspection facilities such as /proc/<pid>/cmdline, process-monitoring tools, audit services, diagnostic utilities, or command telemetry. URLs may also be retained by HTTP proxy or debugging infrastructure.

Attack Path

  1. A user exports a valid token in BILI_ACCESS_KEY.
  2. The user invokes bilibili-garb-collection.sh for a collection containing a lottery ID.
  3. Line 214 starts curl with the token embedded in its URL argument.
  4. While the process is active, another local process or user with sufficient process-inspection access reads the curl command line.
  5. The attacker extracts access_key from the captured URL.
  6. The attacker reuses the token against Bilibili APIs until it expires or is revoked.

Exploitation depends on local process-visibility controls and timing, but repeated invocations or process-monitoring software can make collection practical.

Impact Assessment

Disclosure grants possession of the affected Bilibili access token. The exact privileges depend on the token's account scope and Bilibili's server-side authorization controls. Pote ...[truncated 266 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not place authentication secrets in command-line arguments.
  • Prefer an API authentication method that accepts the token in an authorization header or protected request body, if supported by the endpoint.
  • If Bilibili requires access_key as a query parameter, replace the external curl invocation with an in-process HTTP client. This prevents the full URL from appearing in a separate process's argument vector.
  • Ensure application and proxy logs redact query parameters named access_key, SESSDATA, csrf, and sign.
  • Run the script under a dedicated, least-privileged account with restrictive process-visibility controls.
  • Rotate any token suspected of having been exposed.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/garb-benefit-scan.py:61
Finding

Plaintext credential file is loaded without permission or source-control safeguards

Content
View full analysis

Vulnerability Details

File Location: scripts/garb-benefit-scan.py:61-64
Related Documentation: SKILL.md:12-22, references/bilibili-garb-sop.md:178-189
Vulnerability Type: Insecure storage of account session credentials
Risk Level: Medium

Vulnerable Code:

python
# Try config file first
if CREDS_FILE.exists():
    with open(CREDS_FILE, "r", encoding="utf-8") as f:
        creds = json.load(f)

The documented credential file contains the following sensitive fields:

json
{
  "appkey": "27eb53fc9058f8c3",
  "appsecret": "<obtain from Bilibili mobile client>",
  "access_key": "<your access_key>",
  "csrf": "<your bili_jct>",
  "DedeUserID": "<your uid>",
  "SESSDATA": "<your SESSDATA>"
}

Technical Analysis

The recommended setup stores the application secret, access token, CSRF token, session cookie, and user ID together in configs/bili-api-creds.json under the workspace. The loader accepts this file without checking ownership, symbolic-link status, or filesystem permissions.

The project also contains no recorded .gitignore entry protecting this path. Consequently, security depends entirely on the user's ambient umask, workspace access controls, backup configuration, and source-control practices. A permissively created file could be readable by other local users or processes, while a workspace commit or publication could permanently disclose the credentials.

Attack Path

  1. A user follows the documented setup and creates configs/bili-api-creds.json.
  2. The file is created with ambient filesystem permissions because the Skill does not create it securely or validate its mode.
  3. One of the following occurs:
    • another local user or process with workspace read access opens the file;
    • the workspace is backed up or synchronized to a less-trusted location;
    • the unignored file is accidentally added to source co ...[truncated 833 chars]
Remediation
View remediation

Remediation Suggestions

  • Prefer an operating-system secret store, CI secret facility, or short-lived environment injection instead of a workspace plaintext file.
  • If file-based credentials must be supported:
    • require the file to be owned by the current user;
    • reject symbolic links;
    • require mode 0600 or stricter on POSIX systems;
    • open it using protections against symbolic-link substitution where supported;
    • emit a clear error rather than merely warning when permissions are unsafe.
  • Add configs/bili-api-creds.json and equivalent secret files to .gitignore.
  • Provide a committed template such as configs/bili-api-creds.example.json containing placeholders only.
  • Document secure creation, for example with a restrictive umask and explicit chmod 600.
  • Keep credentials outside the project root where practical.
  • Redact these fields from backups, diagnostics, exception messages, and support bundles.
  • Rotate all credentials immediately if the file has ever been committed, published, or exposed to unauthorized readers.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/garb-benefit-scan.py:276
Finding

Partial access token disclosed in console and retained logs

Content
View full analysis

Vulnerability Details

File Location: scripts/garb-benefit-scan.py:276
Vulnerability Type: Sensitive credential material written to logs
Risk Level: Low

Vulnerable Code:

python
print(f"[INFO] 凭证已加载: uid={creds['uid']}, access_key={creds['access_key'][:8]}...")

Technical Analysis

After credentials are loaded, the scanner prints the first eight characters of the Bilibili access token. This output can be retained in terminal scrollback, CI logs, agent execution transcripts, monitoring platforms, support bundles, or redirected output files.

A token prefix generally does not provide direct authentication by itself, so the severity is lower than disclosure of the complete token. Nevertheless, credential material should not be logged. The prefix can correlate token usage across systems, validate guesses, or augment another partial disclosure.

Attack Path

  1. A user runs garb-benefit-scan.py in an environment where standard output is recorded.
  2. Line 276 writes the account UID and the first eight access-token characters.
  3. A person or service with access to the retained logs retrieves this information.
  4. The disclosed prefix is used to correlate the credential across environments or combined with another token disclosure.

No direct full-token recovery from these eight characters alone is demonstrated.

Impact Assessment

The immediate impact is partial disclosure of authentication material and the associated user ID. This is unlikely to permit account access independently, but it unnecessarily weakens credential confidentiality and can increase the value of other leaks. Exposure extends to every system that stores or forwards the scanner's standard output.

Remediation
View remediation

Remediation Suggestions

  • Remove the token prefix from the message entirely.
  • Log only a non-sensitive status, for example:
    python
    print(f"[INFO] Credentials loaded for uid={creds['uid']}")
  • Consider masking or omitting the UID as well when logs may be externally visible.
  • Implement centralized redaction for fields such as access_key, SESSDATA, csrf, appsecret, cookie, and sign.
  • Review existing CI logs, execution transcripts, and support bundles for retained token prefixes and delete them according to the applicable retention policy.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (37)

Tp4

High
Category
MCP Tool Poisoning
Confidence
87% confidence
Finding

The skill description promises benign data collection and classification workflows, but the documented behavior includes authenticated API usage and setup steps for harvesting mobile-app credentials that are not clearly reflected in the declared purpose or permissions. This mismatch can mislead users and orchestration systems about the real trust requirements, causing sensitive tokens to be exposed under the assumption that the skill is only performing simple public-data lookups.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill asks users to obtain and provide highly sensitive authentication artifacts such as SESSDATA, bili_jct, and access_key without any warning about account takeover risk, secure storage, redaction, or revocation. If these tokens are mishandled, logged, or reused by the skill or surrounding tooling, an attacker could perform authenticated actions or access private account data.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation tells users to retrieve authentication material by packet capture and cookies without any warning about account compromise, privacy exposure, or policy/legal risks. Omitting such safeguards normalizes unsafe credential-handling practices and can lead operators to expose active sessions or harvest third-party account tokens.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document explicitly instructs operators to obtain access_key via mobile HTTP traffic capture and session cookies/CSRF tokens from browser cookies. That enables impersonation of real users and unauthorized access to private account data, which goes beyond normal public API usage and creates credential theft and privacy abuse risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The SOP explicitly instructs the operator to use TLS interception tools to capture mobile app traffic and extract live authentication material including access_key, SESSDATA, bili_jct, and DedeUserID. That goes beyond normal garb data lookup and enables account-authenticated API access by harvesting credentials, which materially increases the risk of account compromise, unauthorized data access, and policy or legal violations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill declares broad capabilities involving environment variables, filesystem access, shell execution, and network use, but does not define any explicit tool scope or permission boundaries. In an agent setting, missing scope declarations increase the chance of over-privileged execution and make it harder to audit whether sensitive actions such as reading credentials or making authenticated requests are necessary and constrained.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill description embeds Chinese trigger phrases and presents the skill as operating in a Chinese-language context, but it does not indicate that the user can choose another language or that the locale restriction is intentional and necessary. Under the policy, language constraints should be opt-in or explicitly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The setup instructs users to capture Bilibili mobile app HTTP traffic to extract access_key, session cookies, and related secrets. Encouraging interception of app traffic to obtain live account credentials creates a direct credential-compromise pathway and normalizes unsafe token handling well beyond what is needed for a typical lookup skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
74% confidence
Finding

文档在签名示例和多个接口参数中固定要求 mobi_app 为 iphone、platform 为 ios，属于对客户端平台/环境的硬编码约束。文中未说明这是用户可选项、技术兼容性要求，还是特定区域/平台限定，因此存在未提供用户选择的自然语言策略约束问题。

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

While an external API call alone is usually benign, this specific endpoint is the authenticated benefit API described as requiring captured access_key, CSRF token, and cookies to retrieve complete user-linked data, including discontinued items. In this context, the outbound request is dangerous because it is coupled to unauthorized credential use and private account-data access.

Content

Scanner excerpt · references/bilibili-garb-api-reference.md (reported line 155)May include surrounding context.

绝版装扮的唯一数据源。

text
GET https://api.bilibili.com/x/garb/v2/user/suit/benefit

| 参数 | 类型 | 说明 |

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The reference includes authenticated endpoints for user asset inventory, owned cards, and transfer history, which materially expand access to private account information beyond basic garb lookup. Even if framed as management functionality, documenting broad authenticated enumeration increases the chance of unnecessary collection and misuse of personal account data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This authenticated asset-list endpoint enumerates a user's owned garb inventory. In context, the documentation pairs it with packet-captured credentials and cookies, turning an otherwise ordinary external request into a private-data access mechanism with unnecessary account exposure.

Content

Scanner excerpt · references/bilibili-garb-api-reference.md (reported line 186)May include surrounding context.

6. 用户资产列表

text
GET https://api.bilibili.com/x/garb/user/asset

| 参数 | 类型 | 说明 |

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This endpoint retrieves user-specific garb asset details and therefore accesses private account state. Given the surrounding instructions to obtain credentials through capture and cookies, it materially contributes to unauthorized account inspection risk.

Content

Scanner excerpt · references/bilibili-garb-api-reference.md (reported line 200)May include surrounding context.

7. 用户装扮资产详情

text
GET https://api.bilibili.com/x/garb/v2/user/suit/asset

| 参数 | 类型 | 说明 |

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

The collection-list endpoint accesses account-scoped collection data tied to a specific vmid and signed requests. In the context of captured access tokens, this extends the skill from public metadata lookup into private user-profile enumeration.

Content

Scanner excerpt · references/bilibili-garb-api-reference.md (reported line 213)May include surrounding context.

8. 收藏集列表

text
GET https://api.bilibili.com/x/garb/right/collection/list

| 参数 | 类型 | 说明 |

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This endpoint reveals user-held digital card data and card numbers, which are account-specific and potentially sensitive. Combined with cookie-based access instructions, it enables unauthorized inspection of personal digital asset holdings.

Content

Scanner excerpt · references/bilibili-garb-api-reference.md (reported line 228)May include surrounding context.

9. 用户持有卡片

text
GET https://api.bilibili.com/x/vas/user/dlc/card/list

| 参数 | 类型 | 说明 |

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Transfer history is especially sensitive because it exposes behavioral and relationship data about sent/received digital assets. In this skill context, documenting a signed endpoint for transfer records significantly increases privacy risk and potential misuse beyond simple garb management.

Content

Scanner excerpt · references/bilibili-garb-api-reference.md (reported line 245)May include surrounding context.

10. 转让记录

text
GET https://api.bilibili.com/x/vas/dlc_act/transfer/listV2

| 参数 | 类型 | 说明 |

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document directs operators to collect and store multiple active Bilibili secrets in a local JSON file for routine use. Even if intended for legitimate querying, concentrating reusable credentials in plaintext local config for a narrowly scoped skill expands the blast radius of compromise and normalizes unsafe secret handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill provides concrete instructions for handling sensitive credentials but omits warnings about the sensitivity of those secrets, the risks of interception, local plaintext storage, and unauthorized reuse. In a skill context, this omission makes unsafe operational behavior more likely and increases the chance of accidental credential leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The verification example embeds access_key and cookie-derived values directly into the curl command line, where they can leak via shell history, process listings, terminal logs, or monitoring tools. This is especially risky because the values are reusable authentication artifacts tied to a user account.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script reads BILI_ACCESS_KEY from the environment and, when present, sends it to an authenticated Bilibili API to fetch lottery detail data. That expands the skill from public metadata lookup into authenticated account-scoped access without clear disclosure or necessity, creating risk of unintended credential use and privacy-sensitive data access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The authenticated curl request includes access_key in the query string with no user-facing warning, consent, or disclosure in output/usage text. Query-string credential use increases exposure through logs, process inspection, and debugging artifacts, while the lack of notice makes silent credential transmission more concerning in a data-collection skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This external request transmits an access_key to an authenticated endpoint, making it materially different from ordinary public API usage. Because the credential is sourced implicitly from the environment and embedded in the URL, it can leak via logs or tooling and can authorize data access beyond the skill's declared public lookup scope.

Content

Scanner excerpt · scripts/bilibili-garb-collection.sh (reported line 214)May include surrounding context.

sh
FRAME_IMAGE=""
            FRAME_NAME=""
            if [ -n "$LOTTERY_ID" ] && [ -n "$ACCESS_KEY" ]; then
                LOTTERY_RESPONSE=$(curl -s "https://api.bilibili.com/x/vas/dlc_act/lottery_home_detail?act_id=${ID}&lottery_id=${LOTTERY_ID}&mobi_app=iphone&platform=ios&appkey=${APPKEY}&access_key=${ACCESS_KEY}" 2>/dev/null)
                FRAME_IMAGE=$(echo "$LOTTERY_RESPONSE" | jq -r '.data.collect_list.collect_infos[] | select(.redeem_item_type==3) | .redeem_item_image' 2>/dev/null | head -1)
                FRAME_NAME=$(echo "$LOTTERY_RESPONSE" | jq -r '.data.collect_list.collect_infos[] | select(.redeem_item_type==3) | .redeem_item_name' 2>/dev/null | head -1)
            fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bilibili-garb-api-reference.md (reported line 71)May include surrounding context.

md
# 搜索收藏集/套装 - 官方API优先，藏馆补充说明
# 输出格式：收藏集输出biz_id，套装输出item_id

API_URL="https://api.bilibili.com/x/garb/v2/mall/home/search"
APPKEY="27eb53fc9058f8c3"

# Gallery databases (optional, set these to your local data paths)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bilibili-garb-api-reference.md (reported line 97)May include surrounding context.

md
# 搜索收藏集/套装 - 官方API优先，藏馆补充说明
# 输出格式：收藏集输出biz_id，套装输出item_id

API_URL="https://api.bilibili.com/x/garb/v2/mall/home/search"
APPKEY="27eb53fc9058f8c3"

# Gallery databases (optional, set these to your local data paths)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bilibili-garb-api-reference.md (reported line 112)May include surrounding context.

md
# 搜索收藏集/套装 - 官方API优先，藏馆补充说明
# 输出格式：收藏集输出biz_id，套装输出item_id

API_URL="https://api.bilibili.com/x/garb/v2/mall/home/search"
APPKEY="27eb53fc9058f8c3"

# Gallery databases (optional, set these to your local data paths)