Video To Text

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:15 AM UTC
• Version: 0.1.0

Overview

This video transcription skill mostly does what it claims, but it asks users to handle Bilibili login/session credentials in unsafe ways that deserve review before installation.

Review this skill before installing. Use it only in an isolated environment, prefer a virtual environment with pinned dependencies, avoid running installation commands with sudo unless necessary, and do not put Bilibili session cookies on the command line or hardcode them into the script. If you already used the documented credential method, consider clearing shell/log history and rotating the session credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:100

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:100-102
Vulnerability Type: Unpinned and non-reproducible dependency installation
Risk Level: Medium

Vulnerable Code

bash

# Install dependencies
pip3 install bilibili-api-python yt-dlp faster-whisper aiohttp requests

Technical Analysis

The documented installation command retrieves the latest available versions of multiple third-party packages without version constraints, package hashes, or a lock file. Installation is therefore mutable and cannot be reproduced reliably from the reviewed project.

Python packages can execute package-controlled code during installation and when imported. In particular, the script directly imports or uses requests, faster_whisper, and bilibili_api, while yt-dlp is executed as an external command. If an upstream release, maintainer account, distribution artifact, or dependency in the transitive dependency graph is compromised, following the documented installation process could introduce attacker-controlled code into the user's environment.

The audit found no evidence that the listed package names are deliberate typosquatting attempts or that the current packages are malicious. The vulnerability is the absence of dependency integrity and version controls, not a confirmed compromise of an upstream package.

Attack Path

1. An attacker compromises an upstream package, maintainer account, release process, or transitive dependency.
2. The attacker publishes a malicious version under one of the dependency names used by the documented command.
3. A user follows SKILL.md and runs the unpinned pip3 install command.
4. Package installation or a later import executes the malicious package code with the privileges of the user running the command.
5. The malicious dependency may access files, credentials, network resources, and processes available to that user.

Impact Assessment

Successful exploitation ...[truncated 465 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed, exact version.
2. Generate a lock file that also fixes all transitive dependency versions.
3. Require package hashes, such as by using a requirements file with pip install --require-hashes -r requirements.txt.
4. Obtain packages only from an explicitly configured trusted index and review unexpected transitive dependencies.
5. Add automated dependency vulnerability and provenance scanning to the release process.
6. Install the dependencies inside an isolated virtual environment rather than a global Python environment.
7. Remove aiohttp from the direct installation instructions if it is not a required direct dependency, and document why every remaining package is needed.
8. Review and deliberately pin the yt-dlp executable because the script invokes whichever matching executable is resolved from the process PATH.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/video_to_text.py:196

Finding

Bilibili Session Credentials Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Locations: SKILL.md:72-76, scripts/video_to_text.py:196-208
Vulnerability Type: Sensitive credentials accepted and documented as command-line arguments
Risk Level: Medium

Vulnerable Code

Documentation encouraging users to place credentials on the command line:

bash

python3 scripts/video_to_text.py "https://www.bilibili.com/video/BVxxx" \
    --sessdata "xxx" \
    --bili-jct "xxx" \
    --buvid3 "xxx"

Argument definitions and credential assignment:

python

# B站认证参数
parser.add_argument("--sessdata", default=None, help="B站 SESSDATA")
parser.add_argument("--bili-jct", default=None, help="B站 bili_jct")
parser.add_argument("--buvid3", default=None, help="B站 buvid3")

args = parser.parse_args()

# 更新认证信息（命令行参数优先）
global BILIBILI_CREDENTIALS
if args.sessdata:
    BILIBILI_CREDENTIALS["sessdata"] = args.sessdata
if args.bili_jct:
    BILIBILI_CREDENTIALS["bili_jct"] = args.bili_jct
if args.buvid3:
    BILIBILI_CREDENTIALS["buvid3"] = args.buvid3

Technical Analysis

SESSDATA, bili_jct, and buvid3 are Bilibili session and authentication values. Supplying them as ordinary command-line options can expose their plaintext values outside the Python process.

Depending on the host configuration, complete command lines may be recorded in shell history, process-monitoring systems, terminal transcripts, CI/CD logs, job definitions, diagnostic reports, or operating-system process listings. Other local users or operators with access to those sources may be able to recover the credentials while the process is running or after it exits.

The script does not intentionally print or transmit these values to an unrelated endpoint, and no credential-exfiltration behavior was found. The issue is the insecure input channel recommended by the documentation and implemented by the argument parser.

Attack Path

1. A user follows the documented exam ...[truncated 1186 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the credential-bearing command-line options or mark them as deprecated and reject their use after a transition period.
2. Prompt interactively using getpass.getpass() so credentials are not echoed or included in the process command line.
3. Alternatively, use an operating-system credential store or a configuration file restricted to the owning user, such as mode 0600 on supported Unix-like systems.
4. If environment variables are supported for automation, document that they may still be exposed by debugging tools, process environments, or CI logs and must be configured as masked secrets.
5. Ensure credentials are never written to application logs, exception messages, telemetry, or transcript output.
6. Avoid recommending hardcoded credentials in the source-level BILIBILI_CREDENTIALS dictionary, because source files are commonly committed, copied, and backed up.
7. Update SKILL.md with secure credential setup and rotation instructions.
8. Advise users who previously used the documented command-line method to clear relevant shell and automation logs and revoke or rotate exposed session credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents capabilities that include reading/writing local files, making network requests, and invoking shell commands, but it declares no explicit tool scope or permissions boundary. In an agent environment, that omission increases the chance the skill is invoked with broader privileges than intended and makes review/enforcement of least privilege difficult.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The invocation description is broad enough to match many ordinary requests involving video, audio, subtitles, or transcription. In a skill-routing system, that can cause over-triggering of a network- and shell-capable skill, leading to unnecessary exposure to untrusted URLs, local file paths, and external binaries when a narrower or safer tool might suffice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation instructs users to pass Bilibili session credentials on the command line, where they may be exposed through shell history, process listings, logs, or monitoring tools. Because these values are effectively authentication tokens, disclosure could allow account misuse or session hijacking.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

pip3 install bilibili-api-python yt-dlp faster-whisper aiohttp requests

Ensure ffmpeg is installed

Ubuntu/Debian: sudo apt install ffmpeg

CentOS: sudo yum install ffmpeg

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

pip3 install bilibili-api-python yt-dlp faster-whisper aiohttp requests

Ensure ffmpeg is installed

Ubuntu/Debian: sudo apt install ffmpeg

CentOS: sudo yum install ffmpeg

text

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_to_text.py (reported line 125)May include surrounding context.

python

url
    ]
    
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"❌ 下载失败: {result.stderr}")
        sys.exit(1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Accepting Bilibili credentials directly on the command line exposes them to local process inspection, shell history, job logs, and monitoring tools. These tokens can grant authenticated account access or session reuse if leaked, making credential theft materially easier in multi-user or managed environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The user-facing module description and CLI help strings are presented in Chinese only, which imposes a specific language without any visible opt-in or alternative. The policy requires avoiding forced language or locale choices unless justified or user-selectable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.