ClawHub
Back to skill

Security audit

bilibili-video-analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill broadly does what it claims, but it handles Bilibili login/video data and contains unsafe parsing, dependency, and disclosure gaps that users should review before installing.

Install only in an isolated environment, avoid using a high-value Bilibili account, review dependency versions before installing, and do not process private or sensitive videos unless you are comfortable storing transcripts/screenshots locally and sending transcript content to an external LLM. The eval() parsing issue should be fixed before using untrusted media.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/screenshot_tool.py:365
Finding

Arbitrary Python Expression Evaluation of Media-Derived Metadata

Content
View full analysis
Remediation
View remediation

other

Warning
Location
scripts/llm_analyzer.py:39
Finding

Indirect Prompt Injection Through Untrusted Video Metadata and Subtitles

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/report_generator.py:92
Finding

Unsanitized LLM and Video Content Written to Markdown Reports

Content
View full analysis
') lines.append("") lines.append("") # Detailed explanation if details: lines.append("### 📖 详细说明") lines.append("") lines.append(details) lines.append("") ``` The same raw insertion pattern is also used for key points and summary fields later in the function. ### Technical Analysis The ...[truncated 2189 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Third-Party Dependencies Without Integrity Verification

Content
View full analysis
=1.2.0 openai-whisper>=20231117 ``` Related installation guidance in `SKILL.md:35-38` is: ```bash pip install railgun-bili-tools ``` ### Technical Analysis Both dependencies use open-ended lower-bound constraints. A future package version satisfying these constraints can be installed without any project review. No lock file, exact version, package hash, or integrity-verification procedure is provided. This is particularly sensitive for `railgun-bili-tools`, because the project imports its authentication and parser modules directly: ```python from bilibili_dl.auth import BilibiliAuth from bilibili_dl.parser import BilibiliParser ``` The dependency therefore executes inside the analyzer process and handles Bilibili login credentials. `openai-whisper` and its transitive dependencies also execute local code and may download model assets. The audit did not establish that either named package is currently malicious. The vulnerability is the absence of version and artifact integrity controls, which increases exposure to package-account compromise, malicious future releases, dependency substitution, and unexpected breaking behavior. ### Attack Path 1. A dependency publisher account or package-distribution channel is compromised, or a malicious future release is published. 2. The malicious version still satisfies the project's `>=` constraint. 3. A user installs or upgrades the project dependencies. 4. The package executes during installation, import, authentication, video download, or transcription. 5. Malicious package code gains the privileges and accessible data of the invoking user. ### Impact Assessment A compromised dependency could obtain arbitrary code execution under the invoking user's account. Because the downloader dependency participates in au ...[truncated 392 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (36)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A second description/behavior mismatch finding points to the same core issue: the skill claims link-based Bilibili video analysis and report generation, while the shown implementation excerpts primarily operate on local artifacts such as SRT files and FFmpeg commands. This can mislead operators into granting broader trust or access than warranted and obscures the true attack surface.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A second description/behavior mismatch finding points to the same core issue: the skill claims link-based Bilibili video analysis and report generation, while the shown implementation excerpts primarily operate on local artifacts such as SRT files and FFmpeg commands. This can mislead operators into granting broader trust or access than warranted and obscures the true attack surface.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/llm_analyzer.py (reported line 107)May include surrounding context.

python
请开始分析并返回标准JSON格式的结果。"""
    
    return prompt


def interactive_analyze(video_info: Dict, srt_content: str) -> Dict[str, Any]:

eval() call detected

High
Category
Dangerous Code Execution
Confidence
99% confidence
Finding

Using eval() on ffprobe-derived data is dangerous because it executes arbitrary Python expressions if the parsed value is attacker-controlled or if ffprobe output is spoofed or malformed. In a skill that analyzes user-supplied videos, this creates a plausible code-execution path in the host process rather than merely a parsing bug.

Content

Scanner excerpt · scripts/screenshot_tool.py (reported line 371)May include surrounding context.

python
'duration': float(data.get('format', {}).get('duration', 0)),
            'width': int(video_stream.get('width', 0)),
            'height': int(video_stream.get('height', 0)),
            'fps': eval(video_stream.get('r_frame_rate', '0/1'))
        }
        
        return info

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README promotes video downloading, login use, subtitle transcription, and third-party AI analysis, but does not warn users that credentials may be used, copyrighted/private content may be processed, and transcripts or metadata may be transmitted to external services such as Claude or Whisper-backed components. In this skill context, the omission is more significant because the workflow explicitly involves authentication and cloud AI processing, which can expose account, content, or privacy-sensitive data if users are not informed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill documents shell execution, file reads, and file writes, but does not declare any tool scope such as allowed-tools or permissions. This creates an authorization and review gap: an agent may invoke filesystem and shell capabilities that users or platform policy did not explicitly approve, including downloading content and writing large local artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill omits an explicit warning that it downloads third-party video content and stores potentially large local files and screenshots. This is risky because users may not realize the privacy, copyright, storage, and retention implications before the agent performs disk- and content-handling actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The listed trigger phrases such as "帮我总结这个视频的知识点", "生成这个视频的学习报告", and "提取这个视频的关键内容" are generic video-summary requests and are not limited to Bilibili links or educational content. Without tighter constraints or negative examples, the skill could be invoked for unrelated video-analysis tasks.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt install ffmpeg

Windows:

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

该最佳实践文档从标题到全部操作说明均固定为中文，且未说明这是面向中文用户或特定区域场景的限定文档。根据语言/locale 政策，若技能内容强制单一语言而无用户选择或明确、合理的区域性说明，属于自然语言层面的策略问题。

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown checklist appears to require Chinese as the operating language for the skill content, and there is no indication that users may choose another language or that the restriction is justified by a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script's banner, prompts, help text, and status messages are written in Chinese throughout, which effectively forces a specific language for all users. The file does not provide any opt-in language selection or document that the tool is intentionally limited to a Chinese-speaking audience.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_video.py (reported line 149)May include surrounding context.

python
print(f"执行命令: {' '.join(cmd)}\n")
    
    try:
        result = subprocess.run(cmd, check=True)
        
        if result.returncode == 0:
            # 查找下载的视频文件

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_video.py (reported line 201)May include surrounding context.

python
print(f"执行命令: {' '.join(cmd)}\n")
    
    try:
        result = subprocess.run(cmd, check=True)
        
        if result.returncode == 0:
            # 查找下载的视频文件

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The full subtitle content is read and passed into an LLM analysis function without any visible consent, warning, or privacy guardrails. If the analyzer sends content to a remote model provider, sensitive or copyrighted transcript material could be transmitted off-device unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The prompt text requires the LLM to analyze and return results entirely in Chinese, including Chinese academic phrasing and field descriptions. This imposes a language/locale choice on the user without opt-in, which matches the policy category for forced language constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module description explicitly defines the skill as a Chinese-language markdown report generator. Across the file, user-facing output and generated report labels are fixed in Chinese, with no indication that the user can choose another language or locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module description, docstrings, CLI usage text, and user-facing messages are all presented in Chinese, which effectively forces a specific language for interaction. The file does not offer an alternative language or explain that the tool is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/screenshot_tool.py (reported line 32)May include surrounding context.

python
"❌ 未找到 FFmpeg!\n\n"
            "请先安装 FFmpeg:\n"
            "  macOS:    brew install ffmpeg\n"
            "  Ubuntu:   sudo apt install ffmpeg\n"
            "  Windows:  从 https://ffmpeg.org/download.html 下载\n"
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/screenshot_tool.py (reported line 37)May include surrounding context.

python
)
    
    try:
        result = subprocess.run(
            ['ffmpeg', '-version'],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/screenshot_tool.py (reported line 109)May include surrounding context.

python
# 重试机制
    for attempt in range(retry):
        try:
            result = subprocess.run(
                cmd,
                capture_output=True,
                text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/screenshot_tool.py (reported line 301)May include surrounding context.

python
]
    
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/screenshot_tool.py (reported line 343)May include surrounding context.

python
]
    
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/screenshot_tool.py:371