Bilibili Analytics

• Analyzed: May 11, 2026, 4:57 AM
• Findings: 1
• Version: 1.0.0
• Hash: 87c5b693f3b0d5ac12766c0607cd2d7845c61736ac0fd3f297a470d46d3ae166
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed for legitimate Bilibili data analysis. However, the `scripts/scrape_videos.sh` file contains a shell injection vulnerability. The `KEYWORD` argument is directly embedded into the `agent-browser open "$URL"` command without proper sanitization, allowing an attacker to inject arbitrary shell commands if they can control the `KEYWORD` input. This is a critical vulnerability, but there is no clear evidence of intentional malicious behavior by the skill developer, thus classifying it as suspicious rather than malicious.