📺 Bilibili Skill

This skill appears to be a legitimate Bilibili CLI wrapper, but it has important mismatches and risky recommendations you should review before installing. Key points: (1) It requires sensitive Bilibili cookies (SESSDATA, bili_jct, buvid3) even though the registry metadata doesn't declare them — do not store these in plaintext under the shared workspace unless you accept the risk. (2) The README instructs adding an MCP server entry to your ~/.openclaw/openclaw.json that points to an external script in the workspace — that lets the agent run that code and increases risk; only add this if you trust the source and have inspected the referenced code. (3) Avoid running ambiguous installer commands (the docs mention pip with --break-system-packages and example use of curl | sh in a posted message); install dependencies from trusted sources and avoid --break-system-packages. (4) Review the bilibili-cli implementation you will invoke (the skill expects /root/.openclaw/workspace/external/bilibili-api/bilibili-cli.py) — ensure it's the authentic project and inspect it for unexpected network endpoints or telemetry. (5) If you proceed, keep cookies in a secure secrets store or environment scoped to the process, not an unencrypted workspace file, and consider manual, minimal configuration rather than auto-adding MCP servers. If you want higher confidence, ask the maintainer for a provenance link to the exact bilibili-cli they expect and for the skill manifest to be updated to declare the required env vars.