Bilibili Up Master

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:32 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a Bilibili analytics/reporting helper, but its code weakens HTTPS security for the whole Python process and has unsafe local file helpers.

Review this skill before installing. Its Bilibili-focused browsing and report generation are disclosed and mostly coherent, but the Python code should be fixed to keep normal HTTPS certificate verification enabled and to constrain local file paths before use. Treat /tmp/bilibili-data as locally readable cache/report output and avoid using logged-in Bilibili sessions or creator publishing workflows unless you explicitly intend that access.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: bilibili_up_master.py:16
• Finding: Process-Wide TLS Certificate Verification Disabled## Vulnerability Details **File Location**: `bilibili_up_master.py`, lines 16-17 **Vulnerability Type**: Global TLS verification bypass **Risk Level**: High ### Vulnerable Code ```python ssl._create_default_https_context = ssl._create_unverified_context ``` ### Technical Analysis The module replaces Python's default HTTPS context factory with an unverified context. Consequently, HTTPS requests made through compatible standard-library clients after this module is imported may no longer validate server certificates or host identity. This modification is process-wide rather than limited to a single Bilibili request. Even though the audited implementation does not currently invoke `urllib.request`, another component running in the same process could rely on the modified default context. An attacker capable of intercepting network traffic could then present an untrusted certificate without causing certificate validation to fail. ### Attack Path 1. The application or Agent imports `bilibili_up_master.py`. 2. The module globally replaces the default verified HTTPS context. 3. The same process subsequently performs an HTTPS request through a client that uses this default context. 4. An attacker with a privileged network position intercepts the connection and presents an invalid or attacker-controlled certificate. 5. The client accepts the certificate, allowing the attacker to observe or modify HTTPS traffic. ### Impact Assessment Successful exploitation could compromise the confidentiality and integrity of HTTPS traffic originating from the affected process. Depending on later requests, exposed information could include API responses, session identifiers, authentication material, or user data. Modified responses could also influence downstream application behavior. The flaw does not independently grant local code execution or elevated operating-system privileges. Its scope is limited to compatible HTTPS operations performe ...[truncated 64 chars]
• Remediation: ## Remediation Suggestions - Remove the assignment to `ssl._create_default_https_context`. - Use Python's verified default TLS behavior. - If a private certificate authority is required, create a narrowly scoped context with `ssl.create_default_context(cafile="trusted-ca.pem")`. - Pass any custom context only to the specific request that requires it rather than changing process-wide behavior. - Do not provide an option that silently disables certificate or hostname validation. - Add a regression test confirming that requests made with an invalid or self-signed certificate fail verification.

T09 · Insecure Skill Coding Practices

Warning

• Location: bilibili_tools.py:17
• Finding: Path Traversal in Configurable JSON Storage Helpers## Vulnerability Details **File Location**: `bilibili_tools.py`, lines 17-29 **Vulnerability Type**: Arbitrary file read and overwrite through path traversal **Risk Level**: Medium ### Vulnerable Code ```python def save_json(self, filename: str, data: dict) -> str: filepath = os.path.join(self.data_dir, filename) with open(filepath, 'w', encoding='utf-8') as f: json.dump(data, f, ensure_ascii=False, indent=2) return filepath def load_json(self, filename: str) -> Optional[dict]: filepath = os.path.join(self.data_dir, filename) if os.path.exists(filepath): with open(filepath, 'r', encoding='utf-8') as f: return json.load(f) return None ``` ### Technical Analysis Both methods accept an unrestricted filename and join it to the configured data directory without validating that the resulting path remains inside that directory. `os.path.join` does not enforce directory containment. An absolute filename discards the base path, while traversal components such as `../` can resolve outside it. If an untrusted caller can control `filename`, `load_json` can read an accessible JSON file outside `/tmp/bilibili-data`, and `save_json` can overwrite an accessible file with attacker-selected JSON content. Exploitation depends on these helper methods being exposed through the Agent or application integration; the audited CLI does not directly expose them. ### Attack Path 1. An attacker causes an application or Agent integration to call `save_json` or `load_json` with an attacker-controlled filename. 2. The attacker supplies an absolute path or a traversal path such as `../../target.json`. 3. `os.path.join` produces a path outside the intended data directory. 4. The method opens that path without a containment check. 5. The target file is read as JSON or overwritten with serialized JSON, subject to the process account's filesystem permissions. ### Impact Assessment ` ...[truncated 446 chars]
• Remediation: ## Remediation Suggestions - Reject absolute paths, path separators, null bytes, and `.` or `..` path components. - Resolve the base and candidate paths before access and verify that the candidate remains within the base directory. - Use generated identifiers rather than accepting arbitrary filenames where possible. - Open files using restrictive permissions and avoid following symbolic links when the platform supports secure no-follow operations. - Consider an allowlist such as `^[A-Za-z0-9_.-]+$` if only simple cache filenames are required. - Raise a clear validation error when a path falls outside the configured storage directory. Example containment pattern: ```python from pathlib import Path base = Path(self.data_dir).resolve() candidate = (base / filename).resolve() if not candidate.is_relative_to(base): raise ValueError("Filename escapes the data directory") ```

T09 · Insecure Skill Coding Practices

Warning

• Location: bilibili_up_master.py:39
• Finding: Path Traversal in Core Data Load and Save Functions## Vulnerability Details **File Location**: `bilibili_up_master.py`, lines 39-51 **Vulnerability Type**: Arbitrary file read and overwrite through path traversal **Risk Level**: Medium ### Vulnerable Code ```python def save_data(filename: str, data: dict): filepath = os.path.join(DATA_DIR, filename) with open(filepath, 'w', encoding='utf-8') as f: json.dump(data, f, ensure_ascii=False, indent=2) return filepath def load_data(filename: str) -> Optional[dict]: filepath = os.path.join(DATA_DIR, filename) if os.path.exists(filepath): with open(filepath, 'r', encoding='utf-8') as f: return json.load(f) return None ``` ### Technical Analysis The core storage functions use a caller-supplied filename without canonicalization, filename validation, or a check that the resolved path remains beneath `DATA_DIR`. Absolute paths and parent-directory traversal components can therefore escape `/tmp/bilibili-data`. These functions are importable module-level APIs. In addition, `analyze_up_profile` constructs a cache filename from an UP name at lines 169-171, increasing the likelihood that externally influenced text may eventually reach `load_data`. The exact traversal needed through that prefixed cache name differs from direct invocation, but the underlying helper remains unsafe. ### Attack Path 1. An attacker controls a filename supplied directly or indirectly to `save_data` or `load_data`. 2. The filename contains an absolute path or sufficient parent-directory traversal components. 3. The path is joined to `DATA_DIR` without validating the resolved destination. 4. Python opens the escaped destination. 5. The application reads an external JSON file or overwrites a writable destination with serialized JSON. ### Impact Assessment The read primitive can expose JSON-formatted files available to the process account. The write primitive can replace writable files with ...[truncated 329 chars]
• Remediation: ## Remediation Suggestions - Convert `DATA_DIR` to a resolved `pathlib.Path`. - Reject absolute filenames and any filename containing directory components. - Resolve the candidate destination and enforce containment beneath `DATA_DIR` before reading or writing. - Validate UP names separately and never use raw user-controlled display names as cache filenames. - Derive cache filenames from a safe identifier or a cryptographic hash of the input. - Use safe file-creation practices to reduce symbolic-link attacks in the shared temporary directory. - Add tests covering absolute paths, repeated `../` components, symbolic links, and unusual Unicode path separators. Example safe cache-name strategy: ```python import hashlib cache_id = hashlib.sha256(up_name.encode("utf-8")).hexdigest() cache_file = f"up_{cache_id}.json" ```

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The module is presented as a benign analytics/reporting helper, but it globally disables TLS certificate verification for all HTTPS connections in the process. This enables man-in-the-middle attacks against any current or future urllib-based network access, allowing tampering with fetched data or interception of sensitive traffic without detection.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README states that the skill fetches external data via browser/agent tools and stores data locally in /tmp/bilibili-data/, but gives no warning about what data is collected, retention period, access controls, or privacy implications. In context, this is more concerning because the skill analyzes creators, video metrics, and trends, which may involve persistent collection of third-party data and expose it to other local processes through temporary storage.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The usage section defines broad, unconstrained natural-language triggers such as monitoring hot videos, analyzing creators, and generating reports, without boundaries on scope, target, or required confirmation. In an agent environment, this can cause unintended invocation, unexpected browsing/data collection, or collection of third-party information when ordinary user speech overlaps with skill triggers.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The invocation example "看看这个视频[BV号]" is a broad natural-language phrase that closely resembles everyday speech, with only a placeholder appended. The README does not define stricter trigger boundaries or exclusions, so this could cause unintended activation in normal conversation about a video.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: L044-L046 列出的触发示例如“给我一些B站内容建议”“做什么类型视频容易火”“最近热门趋势是什么”缺少明确的技能边界，其中后两者尤其接近日常咨询表达。文档也没有给出排除条件、负例或更严格的触发范围说明，容易在普通聊天场景中被误判为应调用该技能。

External Transmission

Medium

• Category: Data Exfiltration

Content

- 热门榜: `https://www.bilibili.com/ranking`

### API 接口（可选）
- 热门视频: `https://api.bilibili.com/x/web-interface/ranking/v2`
- UP主信息: `https://api.bilibili.com/x/web-interface/card`

## 运行规则

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

- 热门榜: `https://www.bilibili.com/ranking`

### API 接口（可选）
- 热门视频: `https://api.bilibili.com/x/web-interface/ranking/v2`
- UP主信息: `https://api.bilibili.com/x/web-interface/card`

## 运行规则

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill describes scraping, local storage under /tmp, and optional logged-in operations without a clear user-facing warning or consent boundary. This can lead to unanticipated data collection, session use, and persistence of potentially sensitive account-related or browsing-derived data, especially in an agent environment with browser access.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The class docstrings, returned instructional text, and generated report content are written entirely in Chinese, which imposes a specific language on users. The file does not indicate that the skill is region-specific or provide any opt-in or alternative language behavior.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: Disabling SSL verification suppresses certificate validation and hostname trust checks, so HTTPS no longer guarantees authenticity. In this skill, the current code mainly prepares/report-generates, but the presence of urllib imports and Bilibili URLs means any later network fetches would be silently exposed to interception and response manipulation.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The entire persona definition, examples, and stylistic instructions are written to enforce a Chinese-speaking B站-style voice, with no indication that the assistant should adapt to the user's preferred language. This creates a language/locale policy concern because it implicitly constrains responses to a specific language and cultural register without user opt-in.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list is overly broad and matches many ordinary Bilibili-related user requests such as 热门, 数据, 运营, and 内容建议 without clear scoping or disambiguation. This can cause the skill to activate in situations the user did not intend, potentially routing sensitive queries to the wrong toolset or causing over-collection and over-processing of browsing-derived data.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: All user-facing documentation in this file is presented only in Chinese, with no indication that the skill supports other languages or that this locale restriction is intentional. Per the policy, forcing a specific language without user opt-in can be a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: Persona 段落将身份、语气和示例回复全部固定为中文表达及中文网络语境，且文档没有说明这是可选风格，也未给用户提供语言/locale 选择。根据规则，未经用户选择而强制特定语言属于自然语言层面的策略问题。

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The manifest description and tags are entirely in Chinese, indicating the skill is presented as Chinese-language only, but there is no note that this is optional or region-specific. Under the policy, language constraints should either offer user choice or be clearly justified as locale-specific.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The module docstring and user-facing CLI text present the skill in Chinese only, which can amount to a language policy violation when no user opt-in or alternative language is offered. There is no indication that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The help and usage messages shown to end users are entirely in Chinese, and the file does not provide a language selection mechanism. Under the stated policy, forcing a specific language without user choice or documented justification is a natural-language policy concern.

Static analysis

No suspicious patterns detected.