bili-user-info

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to do what it says: query public Bilibili user profile statistics, with no credential use, persistence, or hidden data handling evident.

This skill looks safe for querying public Bilibili user stats. Before installing, note that it performs outbound requests to Bilibili and may need the Python requests package; avoid using it for high-volume scraping or activity that violates Bilibili’s terms.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Info

#ASI02: Tool Misuse and Exploitation

What this means

The agent may run the included script to send the requested Bilibili user ID to Bilibili and return public profile statistics.

Why it was flagged

The skill instructs the agent to run a local Python helper with a user-supplied Bilibili user ID. This is purpose-aligned and narrowly scoped, but users should understand it performs a live lookup.

Skill content

调用 `scripts/bili_query.py` 脚本查询用户信息；命令格式：`python scripts/bili_query.py --vmid <用户ID>`

Recommendation

Use it for specific user-requested lookups and avoid unnecessary bulk querying.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing or running the skill may require obtaining the requests package from the Python package ecosystem.

Why it was flagged

The skill depends on the external Python package requests using an unpinned lower-bound version. This is a normal dependency for HTTP API access, but it leaves package resolution to the install environment.

Skill content

dependency:
  python:
    - requests>=2.25.0

Recommendation

Install dependencies from trusted repositories and consider pinning dependency versions in controlled environments.