ClawHub
Back to skill

Security audit

Bili Mindmap

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Bilibili-to-XMind purpose, but it needs review because it feeds untrusted video content to the host model and can send audio to ASR services without strong user-facing guardrails.

Install only if you are comfortable letting the skill fetch Bilibili content, use an existing or newly created Bilibili login session, write local output/audio/transcript files, and optionally send audio to configured ASR services such as Aliyun or a Parakeet-compatible endpoint. Use it on trusted videos where possible, review generated context before asking the host model to act on it, and prefer disabling ASR or using a local endpoint when audio privacy matters.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
scripts/prepare_bili_context.py:580
Finding

Untrusted Bilibili Content Is Passed to the Host Agent Without Prompt-Injection Defenses

Content
View full analysis

Vulnerability Details

File Location: scripts/prepare_bili_context.py:580-620
Vulnerability Type: Indirect prompt injection through externally controlled subtitles, summaries, and comments
Risk Level: Medium

Vulnerable Code

python
details = read_text_if_exists(output_dir / "video_details.txt")
subtitles = read_text_if_exists(output_dir / "subtitles.txt")
ai_summary = read_text_if_exists(output_dir / "ai_summary.txt")
comments = read_text_if_exists(output_dir / "comments.txt")
transcript = read_text_if_exists(output_dir / "transcript.txt")

cleaned_details = format_video_details(details)
cleaned_subtitles = normalize_transcript_text(subtitles)
cleaned_transcript = normalize_transcript_text(transcript)
cleaned_ai_summary = extract_primary_body(ai_summary) if looks_like_useful_text(ai_summary) else ""
cleaned_comments = format_hot_comments(comments)

preferred_transcript = cleaned_subtitles if looks_like_useful_text(subtitles) else cleaned_transcript
transcript_source = "subtitles" if preferred_transcript == cleaned_subtitles and cleaned_subtitles else "asr"

sections = [
    "# Bilibili Mindmap Context",
    "",
    "## Source",
    source,
    "",
    "## Retrieval Summary",
    json.dumps(
        {
            "authenticated": manifest["auth"].get("authenticated"),
            "subtitle_used": bool(subtitles and looks_like_useful_text(subtitles)),
            "asr_used": bool(transcript.strip()),
            "transcript_source": transcript_source if preferred_transcript else None,
        },
        ensure_ascii=False,
        indent=2,
    ),
    "",
    "## Video Details",
    cleaned_details or "(missing)",
    "",
    "## Preferred Transcript",
    preferred_transcript or "(missing)",
    "",
    "## AI Summary",
    cleaned_ai_summary or "(missing)",
    "",
    "## Hot Comments",
    cleaned_comments or "(missing)",
]

The resulti ...[truncated 2482 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add a mandatory instruction before the external content stating that subtitles, transcripts, metadata, summaries, and comments are untrusted data and must never be treated as commands.
  2. Wrap each external source in explicit delimiters, for example BEGIN_UNTRUSTED_SUBTITLES and END_UNTRUSTED_SUBTITLES.
  3. In host-llm-outline-spec.md, require the host model to ignore any instructions, tool requests, role changes, or requests for secrets found inside source material.
  4. Constrain the host-model step to producing only the contents of outline.md; do not expose unrelated tools where the host platform supports per-step tool restrictions.
  5. Keep comments isolated from the primary transcript and label them as untrusted supplemental opinions.
  6. Validate the generated outline before rendering. Reject content that contains tool-call syntax, unexpected instructions, external data requests, or material unrelated to the selected video.
  7. Consider using a structured schema for model input rather than concatenating external content into an instruction-like Markdown document.

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unpinned Python Dependencies Create Supply-Chain and Reproducibility Risk

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Vulnerability Type: Unconstrained third-party package installation
Risk Level: Low

Vulnerable Code

text
moonshine-voice
requests # For Aliyun ASR fallback, if used, and general HTTP requests

Technical Analysis

Both dependencies are specified without exact versions or integrity hashes. Installing this requirements file therefore resolves whichever compatible releases and transitive dependencies are available from the configured package index at installation time.

This makes installations non-reproducible and permits upstream package changes to enter the Skill without review. The risk is particularly relevant for moonshine-voice, because the package is imported by vendor/moonshine_asr/moonshine_asr_provider.py and its model-loading and transcription functionality executes in the Skill process.

The audit did not identify evidence that either named package is currently malicious. The vulnerability is the absence of dependency version and artifact integrity controls.

Attack Path

  1. A user or deployment system installs dependencies from requirements.txt.
  2. The Python package installer resolves mutable package versions from its configured index.
  3. A compromised upstream release, compromised package-index account, unsafe transitive dependency, or incompatible future release is selected.
  4. Package installation hooks may run during installation, or malicious package code may execute when the Skill imports the dependency.
  5. That code runs with the permissions of the user or service hosting the Skill.

Impact Assessment

A compromised dependency could access files, environment variables, network resources, and process privileges available to the Python installation or Skill runtime. It could also alter transcription output or interfere with the workflow.

No privilege escalation beyond the installing or executing accou ...[truncated 123 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed exact version.
  2. Generate and commit a lock file that also fixes all transitive dependency versions.
  3. Use hash verification, such as a requirements file containing --hash entries for reviewed distributions.
  4. Install only from trusted package indexes and disable unintended fallback indexes.
  5. Run dependency vulnerability and provenance checks in continuous integration.
  6. Review new dependency versions before updating the lock file.
  7. Install and execute ASR dependencies in a restricted virtual environment or container with minimal filesystem and network permissions.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (34)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The code chunk is a narrow renderer from Markdown outline to XMind format. It accepts --outline and --output arguments, parses bullet indentation and an optional top-level '# ' heading, builds XMind JSON, and writes a zip-based .xmind file. It does not contain any logic for Bilibili-specific input processing, fetching subtitles or comments, transcript fallback, or AI summarization. While XMind generation is related to the declared end product, the primary purpose and capabilities shown here are materially narrower and different from the declared description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is about end-to-end Bilibili video analysis and mind-map generation. The supplied code does something materially different: it is a pure audio transcription helper for Aliyun ASR. It accepts a local audio file, may convert OGG to WAV, reads credentials from a config file, requests an Aliyun token, and sends audio to a speech recognition endpoint. None of the core declared capabilities—Bilibili URL/BV processing, subtitle/comment collection, summarization, transcript fallback orchestration, or XMind/mind-map creation—are present in this code chunk. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description is about a Bilibili-specific workflow that ingests a video URL/BV number and produces mind-map-style notes using multiple data sources such as subtitles, comments, and summaries. The supplied code does none of that. It exposes a simple handle_media(file_path) interface for local media transcription via Aliyun ASR. While speech-to-text could be a supporting component of a larger Bilibili pipeline, this code chunk by itself has a materially different primary behavior and accesses different inputs/resources than described. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is about ingesting Bilibili video identifiers and producing structured notes or mind maps using subtitles, comments, summaries, and transcript fallback. The supplied code does none of that. It is a minimal CLI wrapper for speech recognition: it expects exactly one audio file argument, imports handle_media, and prints the recognition result. This is a materially different primary purpose and input model from the declared Bilibili-to-mind-map workflow, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared purpose describes an end-to-end Bilibili video processing skill that gathers multiple information sources and produces structured notes or mind maps. The supplied code chunk instead performs only automatic speech recognition on a local audio file. Its primary purpose, inputs, and outputs are materially different: input is an audio file path, output is plain transcript text, and there is no Bilibili integration or mind map generation. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/prepare_bili_context.py (reported line 102)May include surrounding context.

python
def make_utf8_env() -> dict[str, str]:
    env = os.environ.copy()
    env.setdefault("PYTHONUTF8", "1")
    env.setdefault("PYTHONIOENCODING", "utf-8")
    env.setdefault("PYTHONLEGACYWINDOWSSTDIO", "1")

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/run_bili_mindmap.py (reported line 39)May include surrounding context.

python
def make_utf8_env() -> dict[str, str]:
    env = os.environ.copy()
    env.setdefault("PYTHONUTF8", "1")
    env.setdefault("PYTHONIOENCODING", "utf-8")
    env.setdefault("PYTHONLEGACYWINDOWSSTDIO", "1")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README explicitly states that the skill collects subtitles, comments, AI summaries, and ASR fallback material, which may include user-generated or speech-derived content, but it provides no warning about privacy, retention, or downstream sharing with host models or third-party transcription services. In this context, users may unknowingly process personal or copyrighted content through external systems, creating privacy and compliance risk even if the feature is functionally intended.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill explicitly instructs use of shell commands, Python scripts, file reads/writes, and network-backed tooling, but it declares no tool scope or permission boundaries. That makes the skill overprivileged by default and increases the chance that a host agent executes login, download, transcription, or file operations without explicit user-visible authorization controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill says it will collect subtitles, comments, AI summaries, and possibly transcripts tied to a logged-in Bilibili session, but it does not give a clear upfront warning about the privacy implications of processing account-linked or potentially sensitive content. Users may unknowingly authorize retrieval and local storage of personal or regulated data, especially when comments and transcripts are aggregated into output files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The preconditions mention cloud ASR via Aliyun but do not clearly warn that audio and derived transcript data may be transmitted to a third-party service. This is dangerous because video audio can contain sensitive speech, and users may not realize external processing occurs before invoking transcription fallback.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill enables implicit invocation without any visible trigger phrase, domain restriction, or tighter scope control. That can cause the agent to activate this skill on loosely related user requests, potentially pulling external Bilibili content or generating artifacts when the user did not clearly intend to use this capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The generated outline headings and fallback content are hard-coded in Chinese, which imposes a specific language on output regardless of user preference. The policy allows locale constraints only when user choice or explicit justification is provided, and this file does not offer either.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/prepare_bili_context.py (reported line 111)May include surrounding context.

python
def run_command(command: list[str], interactive: bool = False) -> subprocess.CompletedProcess[str]:
    if interactive:
        return subprocess.run(command, check=False, env=make_utf8_env())
    return subprocess.run(
        command,
        check=False,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/prepare_bili_context.py (reported line 112)May include surrounding context.

python
def run_command(command: list[str], interactive: bool = False) -> subprocess.CompletedProcess[str]:
    if interactive:
        return subprocess.run(command, check=False, env=make_utf8_env())
    return subprocess.run(
        command,
        check=False,
        capture_output=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

When the Parakeet provider is used, local audio extracted from the Bilibili video is uploaded over HTTP to a configurable transcription endpoint, defaulting to http://localhost:9001/..., without any explicit user-facing notice or consent gate in the code. In this skill context, transcripts may contain copyrighted, private, or sensitive spoken content, so silent transmission to a network service can cause confidentiality and data handling issues, especially if the endpoint is changed to a remote host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This instruction explicitly requires the host LLM to produce a Chinese mind map regardless of user preference. That is a natural-language locale policy issue because the file does not offer a language choice or explain a justified region-specific constraint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_bili_mindmap.py (reported line 47)May include surrounding context.

python
def run(command: list[str]) -> None:
    result = subprocess.run(command, check=False, env=make_utf8_env())
    if result.returncode != 0:
        raise SystemExit(result.returncode)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The top-level docstring says the skill 'only provides speech-to-text functionality' and has no additional features, which actively suggests a narrow implementation. However, the code performs file-format conversion by invoking ffmpeg, which is an additional operational capability beyond straightforward transcription.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The module docstring and method comments describe this as a 'pure ASR' skill with no extra functionality, but the implementation spawns the external ffmpeg binary to convert OGG input before transcription. Process execution is a materially broader capability than simple API-based transcription and is not justified by the surrounding bili-mindmap skill purpose of collecting Bilibili text artifacts.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · vendor/aliyun_asr/aliyun_pure_asr.py (reported line 101)May include surrounding context.

python
if audio_file.endswith('.ogg'):
                wav_file = audio_file.replace('.ogg', '.wav')
                # 转换为16kHz单声道WAV
                subprocess.run([
                    'ffmpeg', '-i', audio_file, '-ar', '16000', '-ac', '1', 
                    '-f', 'wav', wav_file
                ], check=True, capture_output=True)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code sends raw audio content to a remote third-party ASR endpoint without any in-code disclosure, consent mechanism, or privacy guardrails. In this skill context, uploaded audio may contain personal or sensitive speech content, so silent transmission creates a real privacy and compliance risk even if it is functionally necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This wrapper sends user-provided media to an external speech-to-text backend via AliyunPureASR().speech_to_text(file_path) without any disclosure, consent check, or indication of data handling in this file. In a skill that processes Bilibili media and may include user-supplied audio, silent transmission to a third-party service creates a real privacy and compliance risk, especially if the media contains personal data or copyrighted content.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · vendor/moonshine_asr/moonshine_asr_provider.py (reported line 27)May include surrounding context.

python
# If OGG format, convert to WAV using ffmpeg
            if audio_file.endswith('.ogg'):
                wav_file = audio_file.replace('.ogg', '.wav')
                subprocess.run([
                    'ffmpeg', '-i', audio_file, '-ar', '16000', '-ac', '1',
                    '-f', 'wav', wav_file
                ], check=True, capture_output=True)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a skill for turning Bilibili URLs/BV numbers into mind maps by collecting subtitles, comments, summaries, and transcript fallbacks. In this file, OGG handling is implemented by spawning the external ffmpeg binary, which is a stronger execution capability than ordinary transcript processing and is not declared in the stated purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.