Bilibili Fav Downloader

• Outcome: Review
• Latest audit: May 28, 2026 · 10:49 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a Bilibili downloader, but its cookie guide directs users to collect unrelated Douyin session cookies, which is a serious credential-handling mismatch.

Do not follow the included cookie guide as written. Only export cookies for the exact Bilibili domain you intend to use, keep cookie files private with restrictive permissions, avoid sharing them in chat or logs, and review the setup script before running sudo or installing downloaded binaries system-wide.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The cookie instructions are inconsistent with the stated Bilibili use case and direct users to log into douyin.com, a different service. This can cause users to expose unrelated session cookies or credentials, creating a real risk of credential theft, account compromise, or accidental collection of secrets from the wrong domain.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The guide is for a Bilibili favorites downloader, but it instructs users to visit douyin.com and extract Douyin cookies, mixing unrelated services and credentials. This can cause users to disclose active authentication tokens for the wrong platform and creates a serious risk of credential mishandling or accidental exfiltration, especially because the document presents the steps as recommended.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The example cookie file and required fields combine Douyin cookies such as sessionid, uid_tt, and ttwid with Bilibili cookies such as SESSDATA and bili_jct, creating contradictory authentication guidance. This confusion increases the likelihood that users will export, save, and handle sensitive tokens from multiple services unnecessarily, broadening exposure and potentially breaking trust boundaries between accounts.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger conditions are broad enough to match generic requests for help with cookies, IDs, or making a skill, which increases the chance of unintended invocation. In this context, accidental invocation matters because the skill handles sensitive session cookies and may guide users into running shell commands and persistent automation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill tells users to provide a cookie without clearly warning that a cookie is effectively a live session credential. In a downloader skill, this is especially dangerous because users may paste sensitive tokens into unsafe places, enabling account access or misuse if those cookies are exposed.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The Telegram bot token and chat ID are presented as environment variables without noting that the bot token is a secret and may be exposed through shell history, process inspection, or shared environment configuration. If leaked, an attacker could control the bot or abuse notifications and associated integrations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document tells users how to copy and save live authentication cookies, including complete Cookie headers and persistent cookie files, without clearly emphasizing that these values are equivalent to account access. In the context of a downloader skill, this is more dangerous because users are being guided to package credentials into reusable files, which can be leaked, reused, or mishandled by the tool or by anyone with filesystem access.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script transmits status information to Telegram, an external service, but the CLI help and inline documentation do not clearly disclose what content is sent or that enabling the environment variables activates outbound messaging. In a downloader skill that handles account cookies and media metadata, insufficient disclosure can cause users to enable notifications without understanding the privacy implications.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script performs host-level package installation and writes executables into system locations without any confirmation prompt, dry-run mode, or clear warning that it will modify the machine. In a skill context, users may run setup scripts with high trust, so silent environment changes increase the chance of unintended privileged changes and supply-chain exposure from fetched packages/binaries.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if ! command -v ffmpeg &>/dev/null; then
    echo "[*] 安装 ffmpeg..."
    if [ "$PKG_MANAGER" = "apt-get" ]; then
        sudo apt-get install -y ffmpeg
    else
        sudo $PKG_MANAGER install -y ffmpeg
    fi

• Confidence: 86% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if [ "$PKG_MANAGER" = "apt-get" ]; then
        sudo apt-get install -y ffmpeg
    else
        sudo $PKG_MANAGER install -y ffmpeg
    fi
else
    echo "[+] ffmpeg 已安装: $(ffmpeg -version | head -1)"

• Confidence: 86% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

pip install yt-dlp
    else
        # 下载二进制
        sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp
        sudo chmod a+rx /usr/local/bin/yt-dlp
    fi
else

• Confidence: 95% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

else
        # 下载二进制
        sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp
        sudo chmod a+rx /usr/local/bin/yt-dlp
    fi
else
    echo "[+] yt-dlp 已安装: $(yt-dlp --version)"

• Confidence: 91% confidence
• Finding: sudo

VirusTotal

No VirusTotal findings

Static analysis

No suspicious patterns detected.