Bilibili Hot Daily

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:37 AM UTC
• Version: 2.1.2

Overview

The skill fetches public Bilibili trending-video data and can export it locally, with some documentation and packaging issues users should review before installing.

Install only if you are comfortable with a small command-line tool that contacts Bilibili and writes files you explicitly request. Prefer a pinned ClawHub installer version, review or remove the unnecessary npm python dependency before npm-based installation, and be cautious opening exported CSV files in spreadsheet apps. Do not rely on the advertised AI, scheduling, or push features unless a separate implementation is provided and reviewed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: package.json:24

Finding

Unnecessary and Unpinned npm Dependency Named "python"

Content

View full analysis

Vulnerability Details

File Location: package.json:24-26
Vulnerability Type: Supply-chain exposure through an unnecessary, broadly versioned dependency
Risk Level: Medium

Vulnerable Code

json

"dependencies": {
  "python": ">=3.7"
},

Technical Analysis

The project declares the npm package named python as a runtime dependency even though the executable implementation only requires the system python3 binary. This binary requirement is already declared separately in SKILL.md.

An npm package does not install or represent the Python interpreter in the same manner as a system package manager. Consequently, this declaration introduces unrelated registry-controlled code into the installation process without supporting the Skill's actual functionality.

The range >=3.7 does not constrain resolution to a reviewed release, and the project has no lockfile establishing an exact dependency version and integrity hash. Future installations can therefore resolve to package content that was not included in this audit.

Attack Path

1. A user or automated deployment process runs npm install in the project.
2. npm resolves the registry package named python using the unrestricted >=3.7 range.
3. The resolved package and its transitive dependencies are downloaded into the environment.
4. If a resolved package release is compromised or contains unsafe lifecycle behavior, that code may execute during installation or later npm operations.
5. The code runs with the privileges of the account performing the installation.

Impact Assessment

Exploitation depends on malicious or compromised registry content; no malicious dependency payload was present in the audited repository itself. If exploited, package lifecycle code could generally access files, environment variables, network resources, and processes available to the invoking user. It would not inherently obtain elevated operating-system p ...[truncated 54 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the npm python dependency because it is not required by fetch_hot.py.
2. Retain the explicit python3 binary prerequisite in the Skill metadata.
3. Document the minimum supported Python interpreter version in README.md and SKILL.md.
4. If genuine npm dependencies are added later, pin reviewed versions and commit a lockfile containing integrity hashes.
5. Use automated dependency review and registry provenance checks in the release workflow.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Mutable Remote Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:25-29 and README.md:18-22
Vulnerability Type: Unpinned execution of remotely retrieved npm package code
Risk Level: Medium

Vulnerable Code

SKILL.md:25-29:

markdown

## 📦 安装

```bash
npx clawhub@latest install bilibili-hot-daily

text

The same executable instruction appears in `README.md:18-22`:

```markdown
### 安装

```bash
npx clawhub@latest install bilibili-hot-daily

text

### Technical Analysis

The documented installation command directs `npx` to retrieve and execute the release currently associated with the mutable `latest` tag. The effective executable code can therefore change after this Skill has been reviewed.

The command does not pin an exact reviewed version or provide an integrity-verification procedure. This creates a supply-chain trust dependency on the npm package publisher, registry account security, tag management, and all resolved transitive dependencies.

This finding concerns the documented installation path. The audited `fetch_hot.py` implementation itself does not retrieve and execute Python source code.

### Attack Path

1. An attacker compromises the relevant npm publisher account, registry release process, or a dependency used by a future `clawhub` release.
2. A malicious release becomes the target of the `latest` tag.
3. A user follows the installation instructions and runs `npx clawhub@latest install bilibili-hot-daily`.
4. `npx` downloads and executes the mutable package release.
5. The malicious package code executes with the permissions of the invoking user before that user can audit the locally installed Skill.

### Impact Assessment

A compromised package executed through `npx` could access resources available to the invoking account, including project files, user-readable files, environment variables, network connectivity, and child-process execution. The command does not independently gra
...[truncated 141 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed version of the CLI.
2. Where supported, verify the package's integrity, provenance, or signature before execution.
3. Document how users can inspect the package without immediately executing it.
4. Run installation under a non-privileged account and in an isolated environment.
5. Keep the commands in SKILL.md and README.md synchronized.
6. Update pinned versions only after dependency review and release validation.

T09 · Insecure Skill Coding Practices

Warning

• Location: fetch_hot.py:151

Finding

Spreadsheet Formula Injection in CSV Exports

Content

View full analysis

Vulnerability Details

File Location: fetch_hot.py:151-167
Vulnerability Type: CSV formula injection through externally supplied video metadata
Risk Level: Medium

Vulnerable Code

python

def output_csv(videos: List[Dict], output_file: str):
    """输出CSV"""
    if not videos:
        print("[ERROR] 没有数据")
        return

    fieldnames = ['rank', 'title', 'up', 'category', 'views', 'likes', 'coins', 'favorites', 'duration', 'url']

    with open(output_file, 'w', encoding='utf-8-sig', newline='') as f:
        writer = csv.DictWriter(f, fieldnames=fieldnames)
        writer.writeheader()
        for v in videos:
            row = {k: v.get(k, '') for k in fieldnames}
            row['duration'] = format_duration(v.get('duration', 0))
            writer.writerow(row)

    print(f"[OK] 已保存到 {output_file}")

Technical Analysis

The CSV exporter writes externally sourced Bilibili metadata directly into spreadsheet cells. Relevant string fields include title, up, and category. The csv module correctly handles CSV delimiters and quoting, but CSV quoting does not prevent spreadsheet applications from interpreting a cell as a formula.

A value beginning with spreadsheet formula indicators such as =, +, -, or @ may be evaluated when the generated file is opened in compatible spreadsheet software. The exporter does not neutralize these prefixes.

Exploitability depends on an attacker-controlled metadata value being included in the popular-video API response and on the victim opening the CSV in software that evaluates the crafted expression. Modern spreadsheet security controls may reduce the impact, but they do not remove the underlying unsafe export behavior.

Attack Path

1. An attacker creates or controls Bilibili metadata, such as a video title or uploader name, beginning with a spreadsheet formula marker.
2. The attacker's video appears in the public popular-video ...[truncated 975 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat all string values obtained from the remote API as untrusted when exporting them to CSV.
2. Before serialization, neutralize cells whose first non-whitespace character is =, +, -, or @.
3. Prefix dangerous values with an apostrophe or use another neutralization strategy documented for the spreadsheet products being supported.
4. Apply the transformation to every externally sourced string field rather than only to titles.
5. Preserve the original values in JSON output when exact machine-readable data is required.
6. Add tests covering formula prefixes, leading whitespace, tabs, carriage returns, and newline-prefixed formulas.
7. Document that CSV files contain remote content and should be opened with formula evaluation disabled where possible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill description claims daily automation, AI summary generation, and multi-channel push functionality that are not supported by the documented behavior. This can mislead users about what data processing and outbound communication will occur, undermining informed consent and making it harder to assess operational and privacy risk accurately.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · fetch_hot.py (reported line 21)May include surrounding context.

python

# 设置控制台编码
if sys.platform == 'win32':
    os.system('chcp 65001 >nul 2>&1')
    sys.stdout.reconfigure(encoding='utf-8')
    sys.stderr.reconfigure(encoding='utf-8')

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawhub@latest install bilibili-hot-daily, which pulls and executes the latest published package version at install time rather than a pinned, reviewed release. If the upstream package or its dependency chain is compromised, users could execute attacker-controlled code simply by following the documented installation command.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises executable behavior using Python, network access, file export, and shell-based installation, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an avoidable least-privilege failure: users and hosting platforms cannot easily constrain what the skill is allowed to access, increasing the risk of unintended file writes or network operations if the implementation changes or is replaced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The description mentions AI summaries and multi-channel pushing, both of which imply potential transmission of fetched content or derived data to third-party services, but it provides no warning about those network flows. In a skill that processes trending media data and may export results, this omission can cause users to unknowingly send content or metadata off-platform.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx clawhub@latest install bilibili-hot-daily pulls a moving target rather than a pinned, audited version. If the upstream package is compromised or a breaking/malicious release is published, users may execute attacker-controlled install logic simply by following the documented command.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · fetch_hot.py (reported line 26)May include surrounding context.

python

sys.stderr.reconfigure(encoding='utf-8')

# B站API地址
POPULAR_API = "https://api.bilibili.com/x/web-interface/popular"


class BilibiliHotFetcher:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The entire publishing guide is written only in Chinese, and the file does not indicate that the skill or publication process is intentionally limited to Chinese-speaking users or a China-specific audience. Under the language/locale policy check, this is a natural-language constraint without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

Natural-language policy violations include forcing a specific language without user opt-in. This file presents all user-facing instructions and descriptions in Chinese, with no indication that other languages are supported or that the Chinese-only scope is intentional and documented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file contains user-facing natural language in the module docstring and throughout CLI help/output that assumes Chinese as the only language. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This manifest file description says the skill automatically fetches daily hot videos and supports AI summaries and multi-channel pushing, but it does not clarify when the skill should activate or under what user request boundaries it applies. In manifest-like metadata, such broad capability phrasing can contribute to unintended invocation because there are no explicit trigger phrases, scope limits, or exclusion conditions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The natural-language metadata is presented entirely in Chinese and the pricing uses CNY, but the file does not state that the skill is China-specific or offer any language/locale choice. This can be a policy concern when a skill implicitly assumes a specific language or locale without user opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.