Security audit

📺 Bilibili Skill

Security checks for vulnerabilities and agentic risk

Overview

This Bilibili skill is mostly purpose-aligned, but it handles account cookies and account-changing actions in ways that need review before installation.

Review before installing. Use this only with an account you are willing to automate, keep Bilibili cookies out of shared workspace files when possible, avoid copying the shell=True batch examples, do not run the --break-system-packages install command in system Python, and require explicit user approval before posting, deleting, reposting, or liking content.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:169
Finding: Shell Command Injection in Documented Batch-Publishing Examples
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:213
Finding: Unverified Remote Script Execution Recommended to End Users
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Unpinned Dependencies Installed into System Python
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: bilibili-wrapper.sh:8
Finding: Bilibili Session Credentials Stored and Read from a Plaintext Workspace File
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:133
Finding: Credential-Formatted Values Embedded in Public Skill Documentation
Content: View full analysis
Remediation: View remediation
" export BILIBILI_BILI_JCT="" export BILIBILI_BUVID3="" ``` - Determine whether the published values were ever real. - If they were real, revoke the session and rotate all related cookies immediately. - Purge genuine credentials from repository history where feasible. - Add automated secret scanning to commits and release workflows. - Use documentation linting rules that reject realistic session tokens and API credentials. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The README demonstrates use of subprocess.run with shell=True while interpolating content directly into the shell command. If content contains shell metacharacters or attacker-controlled input, this can lead to command injection and arbitrary command execution on the host running the script. In this skill context, the example encourages batch posting and may be copied directly by users, increasing the chance that unsafe code is reused in automation with real account credentials present.
Content: Scanner excerpt · README.md (reported line 131)May include surrounding context.
import time

for content in ["第一条", "第二条", "第三条"]: subprocess.run(f"bilibili-wrapper.sh dynamic publish --content '{content}'", shell=True) time.sleep(3) # 避免风控

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The Python example constructs a shell command using string interpolation and executes it with subprocess.run(..., shell=True), making it vulnerable to command injection if any interpolated value contains shell metacharacters. Since content and cookie values are variable inputs, an attacker or malformed data could execute arbitrary commands on the host.
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
for content in contents: cmd = f"bilibili-cli.py {cookies} dynamic publish --content '{content}'" subprocess.run(cmd, shell=True) time.sleep(3) # 避免风控

text

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The example includes piping a remotely fetched script directly into a shell (curl ... | sh), which allows execution of unreviewed network content with the user's privileges. If the upstream server, network path, or referenced script is compromised, this becomes an immediate remote code execution vector.
Content: Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.
md
✅ 完全免费 ✅ 隐私安全 ✅ 离线可用安装超简单： curl -fsSL https://ollama.com/install.sh | sh ollama run llama3.2 5 分钟就有自己的私有 AI 助手！🎉

Chaining Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: The shell pipe into sh chains network retrieval directly into execution, eliminating any review boundary and amplifying the danger of compromised upstream content. In a skill consumed by agents or copied by users, this pattern normalizes unsafe command chaining that can lead to arbitrary code execution.
Content: Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.
md
✅ 完全免费 ✅ 隐私安全 ✅ 离线可用安装超简单： curl -fsSL https://ollama.com/install.sh | sh ollama run llama3.2 5 分钟就有自己的私有 AI 助手！🎉

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The primary skill description is written as a directive in Chinese ('让 AI Agent 控制 B 站') and the document consistently centers Chinese-language usage for commands and examples, but it does not state that the skill is region-specific or provide language-selection guidance. The policy requires avoiding forced language or locale constraints unless the user is given a choice or the constraint is clearly justified.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description says the skill can '获取弹幕', implying this CLI skill itself provides danmaku retrieval. However, the feature comparison explicitly marks danmaku as unavailable in the CLI tool and available only via the MCP server, and the danmaku example uses MCP rather than the CLI. This is a clear mismatch between the skill description and the documented behavior of this skill file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs users to pass highly sensitive Bilibili session cookies on the command line and references storing them in a workspace file, but does not warn that command-line arguments and plaintext files may be exposed via shell history, process listings, logs, or other tools. In an agent environment, these credentials could be reused to post content, delete dynamics, or interact with the account as the victim.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill documents account-affecting operations such as deleting dynamics, reposting, and liking content without clearly warning that these actions modify user state and may be irreversible or policy-sensitive. In an autonomous or semi-autonomous agent setting, this increases the risk of accidental destructive actions or unauthorized social/account activity.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The wrapper automatically reads long-lived Bilibili authentication cookies from environment variables or a local file and passes them into the CLI without any explicit user confirmation or scope restriction. In an agent/skill context, this creates a credential-handling capability that can enable account actions using ambient secrets, and the manifest description does not clearly disclose that the skill will harvest local auth material.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script accesses sensitive session credentials and forwards them to another program with no user-facing warning, consent step, or disclosure about what secrets are being consumed. In this skill context, that is dangerous because users may invoke a seemingly ordinary Bilibili CLI wrapper without realizing it is pulling account cookies from the environment or filesystem and using them for authenticated actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The skill description and operational examples are entirely in Chinese, and examples such as search terms and output assume Chinese usage without offering an alternative language or explaining that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, a skill should not effectively force a specific language without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.