T01 · Skill Instruction Hijacking
Error
- Location
references/core_workflow.md:34- Finding
Conditional External-Service Promotion Hijacks Agent Output
- Content
View full analysis
- Remediation
View remediation
Security audit
B站评论分析
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Bilibili comment-analysis purpose, but its generated HTML reports handle external and AI-generated content unsafely enough that users should review it before installing.
Install only if you are comfortable sending Bilibili video identifiers through RedFox, saving comment reports locally, and reviewing generated HTML carefully. Avoid opening or sharing generated reports that may contain sensitive commenter metadata until the report generation sanitizes AI summaries and API-supplied URLs and removes unnecessary external font loading.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/backfill_html.py:30- Finding
Stored HTML Injection Through Unsanitized Analysis Data
- Content
View full analysis
{{SUMMARY_POSITIVE}}{{SUMMARY_NEGATIVE}}{{SUMMARY_DEMAND}}{{SUMMARY_COMPETITOR}}``` ### Technical Analysis The backfill script treats JSON values as trusted HTML. It performs direct string replacement without escaping, schema validation, or sanitization. The documented format permits summaries containing HTML list elements. However, the implementation does not restrict input to `ul` and `li`; it accepts arbitrary tags, attributes, URLs, event handlers, and active browser content. Ratio fields are also inserted without validating that they are bounded integers. An attacker-controlled analysis file could therefore contain content such as an image with an `onerror` handler, an iframe, a form, or other active markup. Because the payload is written permanently int ...[truncated 1433 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bili_comment_search.py:375- Finding
HTML Attribute Injection Through Unescaped API-Supplied Image URLs
- Content
View full analysis
``` In contrast, nearby text values are passed through `escape_html`, but the API-supplied image URL values are not escaped or validated. ### Technical Analysis The `cover` and `author_avatar` fields originate in a remote API response. They are copied into the replacement map without HTML attribute encoding or URL-scheme validation. A malicious or compromised API response can include a quotation mark in the cover value, terminate the existing `src` attribute, and inject additional attributes such as event handlers. The resulting payload is stored in the generated HTML report and is interpreted when the report is opened. The `author_avatar` replacement is currently not used by the reviewed template, but retaining an unsafe replacement value creates a latent injection risk if that placeholder is later added to an attribute context. ### Attack Path 1. The RedFox API or its upstream data source returns a crafted `cover` value. 2. The value contains a quote followed by attacker-controlled HTML attributes. 3. `generate_html_report` inserts the value without escaping or validation. 4. The generated report contains attacker-controlled attributes on the image element. 5. The user opens the report. 6. The browser processes the injected attribute and may execute event-driven active content or contact an attacker-controlled resource. This path requires control or compromise of the remote response, or another ability to provide a malicious `w ...[truncated 443 chars]- Remediation
View remediation
other
Note
- Location
assets/report_template.html:9- Finding
Purported Offline Report Loads Undisclosed External Font Resources
- Content
View full analysis
``` ### Technical Analysis The report is described as suitable for offline saving, but opening it causes the browser to preconnect to Google domains and request a remote stylesheet and font resources. These network connections are not required for comment analysis or report functionality. They disclose network metadata to an additional third party and make the report's appearance dependent on network availability. The behavior is visible in the template and is not an encoded or hidden payload. No executable JavaScript is retrieved by these particular elements, but the unnecessary network access conflicts with the report's offline positioning. ### Attack Path 1. The Skill generates an HTML report from the template. 2. The user opens the report while connected to a network. 3. The browser processes the `preconnect` and stylesheet elements. 4. The browser connects to `fonts.googleapis.com` and `fonts.gstatic.com`. 5. Those services receive connection metadata such as the user's IP address, request timing, and browser-provided request information. ### Impact Assessment The issue can expose user network metadata and the approximate time at which a report was opened to third-party font services. It also reduces report availability in restricted or offline environments. It does not provide local code execution, privilege escalation, or access to unrelated system files. ]]>- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description promises sentiment/category analysis and comment processing, but the noted implementation gap suggests that analysis may be performed outside the documented code path while additional metadata is fetched from another API. This mismatch reduces transparency about what data is actually collected and processed, which can mislead users about scope and create privacy and trust risks when exporting comments into HTML reports.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill description promises sentiment/category analysis and comment processing, but the noted implementation gap suggests that analysis may be performed outside the documented code path while additional metadata is fetched from another API. This mismatch reduces transparency about what data is actually collected and processed, which can mislead users about scope and create privacy and trust risks when exporting comments into HTML reports.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>B站评论分析 - {{VIDEO_ID}}</title> <!-- Fonts --> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Archivo+Black&family=Space+Grotesk:wght@300;400;500;600;700&display=swap" rel="stylesheet">
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Overview Enter any Bilibili video link or BV ID to **instantly retrieve comment data**. AI automatically performs four-dimension sentiment analysis (positive / negative / demand / competitor) and generates an interactive HTML report for offline saving. **Feature Overview**
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README says comments are retrieved in real time via the RedFox API, but it does not clearly warn users that video identifiers, comment content, and associated metadata will be transmitted to an external third-party service. This can create a privacy and consent gap, especially when comments may contain personal data, location indicators, or sensitive sentiment signals.
- Content
Unbounded Output
Medium
- Category
- Output Handling
- Confidence
- 87% confidence
- Finding
Advertising a full comment table with 'no truncation' raises output-handling risk because comment text can be arbitrarily long or numerous, increasing chances of oversized prompts, memory pressure, UI degradation, and accidental overexposure of personal or offensive content. In a reporting workflow, unbounded content can also make generated HTML files excessively large or unstable.
- Content
md ### Highlights - **Bilibili meme culture understanding**: Recognizes awsl / yyds / xswl / 爷青回 / 下次一定 and other barrage slang in their real context - **Complete data display**: Work details (views / likes / coins / favorites / danmaku, etc.) and full comment table — no truncation - **Encoding-safe backfill**: Intelligent encoding ensures Chinese analysis content is injected into reports without corruption ---
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README says users can 'Simply describe your video in natural language — no fixed commands to memorize,' which makes activation conditions ambiguous and does not clearly distinguish valid requests from ordinary conversation. This broad wording increases the chance of unintended invocation because it omits explicit trigger scope, constraints, or negative examples.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README says users can 'directly use natural language' and provide a video link or BV号 'without remembering fixed commands,' but it does not define clear activation boundaries or exclusion conditions. This broad invocation description could overlap with ordinary conversation about B站 videos and cause unintended skill activation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Examples such as '下一页', '第3页', '需要', and '生成HTML' are common conversational phrases that are not uniquely tied to this skill. Without explicit session or context constraints in the description, these triggers are ambiguous and may cause accidental invocation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares capabilities that imply access to environment variables, local file read/write, and network resources, but it does not declare any tool scope or permissions boundary in the manifest. That weakens reviewability and least-privilege enforcement, increasing the chance that a user or platform invokes a skill with broader capabilities than expected, including access to API keys and generation of local HTML files.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Several trigger phrases such as '看评论' or generic comment-analysis wording are broad enough to overlap with normal user speech. In an agent ecosystem, that raises the risk of unintended invocation, which is more concerning here because the skill can use environment-backed credentials, access the network, and save report files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill explicitly collects comment content and exports it into offline-shareable HTML reports, yet the description lacks a warning about privacy, redistribution, and handling of potentially sensitive user-generated data. This omission can lead users to overshare reports containing commenter text, IP-attribution fields, nicknames, or other metadata without understanding the consequences.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Allowing activation from broad natural-language requests without tight constraints can cause the skill to trigger unintentionally during ordinary conversation. Because the skill performs network retrieval and writes shareable HTML output, accidental activation could fetch third-party comment data or create local artifacts without clear user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The HTML document sets
lang="zh-CN", which hard-codes a specific language/locale for the rendered report. Under the policy, forcing a locale without user opt-in or a clearly documented region-specific justification is a natural-language policy concern.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file consistently mandates Chinese prompts and responses, such as the required Chinese follow-up messages in L06 and L39, with no opt-in or alternative language path. That creates a language policy concern because the skill appears to force a specific language/locale without user choice or an explicit documented justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script writes fetched comment content, usernames, user IDs, IP属地, and video metadata into a local HTML report under a predictable downloads directory without an explicit notice or opt-in at runtime. While this is part of the skill’s intended functionality, it can create unintended local retention of potentially sensitive personal data and expose it to other local users, backup/sync services, or later accidental sharing.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The file name and heading indicate an English-specific README ('README.en.md'), which suggests the skill may be documented or presented in a fixed language. There is no visible statement offering users a language choice or clarifying that the English locale is optional.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The workflow instructs the agent to automatically launch a generated local HTML file with Start-Process/open, but does not require explicit user consent or warn that this will open a local file/application. Even if the HTML is generated by the skill, it includes fetched external comment content and analysis backfill, so auto-opening increases the risk of surprising execution context, privacy leakage, or unsafe rendering behavior in the user's browser.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This file is a code file, so SQP-3 applies to natural-language text in docstrings and CLI help. The script's description, usage text, and user-facing help/messages are entirely in Chinese, which imposes a specific language on users without opt-in or a documented region-specific justification.
- Content