ClawHub
Back to skill

Security audit

B站搜账号下作品集

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says: it uses a RedFox API key to fetch public Bilibili creator video lists by UID.

Install only if you are comfortable giving this skill a RedFox API key and sending Bilibili UIDs you query to RedFox for lookup. Treat REDFOX_API_KEY as a secret, do not paste it into chats or commit it to repos, and rotate or revoke it if exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill advertises very broad natural-language invocation phrases such as common requests and follow-ups like '下一页/还有更多吗'. In an agent environment, this can cause accidental or unintended triggering during ordinary conversation, leading to unplanned external queries and possible data exposure or action confusion.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs users to place a live API key in configuration files or shell environment variables but never states that the credential is sensitive, should not be shared, or should be stored with least exposure. This increases the chance of accidental leakage through screenshots, checked-in dotfiles, copied config snippets, or shared shell history, which could enable unauthorized use of the external service.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill asks for a B站 UID and instructs the agent to query external B站 data, but it does not disclose that the UID will be sent to an external service/API. This can undermine user privacy expectations and informed consent, especially when identifiers may be linked to browsing interests or account profiling.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def get_api_key() -> str:
    val = os.environ.get("REDFOX_API_KEY", "")
    if not val:
        print("[error] 未找到环境变量 REDFOX_API_KEY，请确认已设置 API Key", file=sys.stderr)
        sys.exit(1)
Confidence
70% confidence
Finding
os.environ.get("REDFOX_API_KEY

Hidden Instructions

High
Category
Prompt Injection
Content
# Bilibili Portfolio Search / bilibili-portfolio-search

---
Confidence
60% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
# B站搜账号下作品集 / bilibili-portfolio-search

---
Confidence
60% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---
name: bilibili-portfolio-search
description: B站账号作品列表实时查询工具。根据B站UP主的UID获取该UP主发布的最新视频作品列表，支持游标翻页浏览更多作品。当用户想查看某个B站UP主的作品列表、B站账号视频、UP主投稿列表时使用。
---
Confidence
60% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
# Core Workflow

## Step 1：理解用户意图，提取UID
Confidence
18% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal