Security audit
Security checks for vulnerabilities and agentic risk
This skill performs a disclosed Bilibili public-profile lookup and does not show hidden data access, persistence, credential use, or destructive behavior.
Install only if you are comfortable with the agent making live requests to Bilibili for user IDs you provide. Avoid bulk queries that could violate Bilibili rate limits or terms, and treat returned public-profile data as time-sensitive.
The skill invokes a Python script that performs network access to the Bilibili API, but the manifest does not declare any tool scope or allowed-tools restrictions. This creates an authorization and review gap: an agent may execute network-capable code without explicit capability disclosure, making misuse, unexpected outbound requests, or policy bypass harder to detect and govern.
The trigger condition lists broad intents such as '询问B站UP主信息' and '分析B站账号数据', which could overlap with many general discussion requests about B站 accounts rather than this specific lookup skill. The file does not provide explicit scope limits, precise trigger phrases, or negative examples to distinguish simple user-info lookup from broader account analysis tasks.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
vmid (str): B站用户ID
"""
self.vmid = str(vmid)
self.stat_api = "https://api.bilibili.com/x/relation/stat"
self.headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"Referer": "https://www.bilibili.com/",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
vmid (str): B站用户ID
"""
self.vmid = str(vmid)
self.stat_api = "https://api.bilibili.com/x/relation/stat"
self.headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"Referer": "https://www.bilibili.com/",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
vmid (str): B站用户ID
"""
self.vmid = str(vmid)
self.stat_api = "https://api.bilibili.com/x/relation/stat"
self.headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"Referer": "https://www.bilibili.com/",
The get_fans docstring states that failures return None, but the implementation returns structured dictionaries like {"error": ...} on HTTP, network, or parsing failures. This is an active contradiction between documentation and behavior rather than a mere omission.
The get_follows docstring documents None as the failure result, while the function returns error dictionaries for API, HTTP, network, and parsing errors. This creates intent-code divergence that can mislead callers about expected behavior.
The get_name docstring promises a string on success and None on failure, but the function returns {"error": ...} in failure cases. This directly contradicts the documented contract and may cause incorrect assumptions by integrators.
No suspicious patterns detected.