Bilibili Analytics

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims: it opens Bilibili search pages, scrapes public video metadata, and writes local analysis reports.

Install only if you are comfortable running local Bash/Python scripts and an external browser automation tool. Review the scripts first, use modest page counts, avoid unusual keyword strings, and expect local JSON/report files to be created from public Bilibili pages.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes external scripts and shell redirection (`scripts/scrape_videos.sh`, `scripts/analyze_data.py`, and `>> data.json`), which implies file read/write capability even though no permissions are declared. This mismatch weakens security review and permission gating because an agent may perform filesystem operations that users and policy layers were not explicitly informed about.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal