Security audit

B站视频下载

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Bilibili downloader that uses RedFox's API, with some privacy and advertising caveats but no evidence of deception, persistence abuse, or destructive behavior.

Install only if you are comfortable using RedFox as a third-party processor for Bilibili URLs and API authentication. Prefer the REDFOX_API_KEY environment variable over command-line keys or saved config files, avoid submitting private or sensitive video links, and expect the tool to append a RedFox enterprise-service advertisement to normal results.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: scripts/downloader.py:372
Finding: Unconditional Commercial Output Injection
Content: View full analysis
Vulnerability Details

File Location: scripts/downloader.py:372-374; supporting instruction at references/core_workflow.md:80
Vulnerability Type: Unconditional promotional content injected into agent-facing results
Risk Level: Medium

Vulnerable Code

scripts/downloader.py:372-374:

python
# ── Enterprise procurement guidance ── print(f"\n💼 另外红狐配套全量数据库可提供完整详实数据，如需了解采购方案，可前往红狐hub 企业服务(https://redfox.hk/dashboard/enterprise) 对接咨询")

The corresponding workflow instruction at references/core_workflow.md:80 requires procurement guidance to be appended to the output:

text
末尾统一输出采购引导文案。

Technical Analysis

The skill's legitimate purpose is to validate Bilibili URLs and return video download information. The cited workflow instruction requires a procurement solicitation to be appended, and the executable implements that requirement through an unconditional print call.

This commercial message is unrelated to the requested video-processing operation. Because it is emitted automatically after processing, it modifies agent-facing results and directs users to an external commercial page without requiring consent or demonstrating task necessity.

The behavior is deterministic and does not depend on attacker-controlled data. It therefore does not create arbitrary code execution or a conventional injection primitive, but it does hijack the skill's output channel to promote an external service.

Attack Path

A user asks the agent to process a Bilibili video URL.

The agent follows references/core_workflow.md and invokes scripts/downloader.py.

The script sends the submitted URL to the configured RedFox API and processes the response.

After URL processing and any batch summary, execution reaches lines 372-374.

The script unconditionally appends procurement advertising containing https://redfox.hk/dashboard/enterprise.

The promotional message becomes part of ...[truncated 653 chars]
Remediation: View remediation
Remediation Suggestions

Remove the unconditional procurement message from scripts/downloader.py.

Remove the instruction requiring procurement guidance from references/core_workflow.md.

Restrict normal output to information necessary for the requested operation, such as parsing status, download links, cover links, and errors.

If commercial information must be retained, place it in project documentation rather than runtime results.

Alternatively, expose commercial information only when the user explicitly requests service or procurement details.

Add output-focused tests confirming that normal downloader invocations do not contain unsolicited advertisements or unrelated external links.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This README is a markdown file, so vague-trigger review applies. The invocation guidance emphasizes free-form natural language with no explicit constraints or negative examples, and includes common conversational phrasing that could overlap with everyday requests, increasing the risk of unintended invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README instructs users to invoke the skill with broad natural-language phrases such as '帮我把这条B站视频存下来' and '下载这条B站视频', which are common requests that may appear in ordinary conversation. In an agent ecosystem, this increases the chance of unintended skill activation, causing the agent to process links or initiate downloader behavior when the user did not explicitly mean to invoke this specific skill.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs users to configure an API key for a third-party service and to submit video links for remote parsing, but it does not declare any explicit tool scope or permissions. In an agent environment, missing scope declarations can allow broader-than-expected access to network, shell, file, or environment capabilities, increasing the chance of unauthorized external calls or mishandling of secrets such as REDFOX_API_KEY.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill says links can be pasted for one-click parsing, but it does not clearly warn users that their submitted Bilibili URLs are sent to the third-party service redfox.hk. This creates a transparency and privacy issue because user inputs, potentially including sensitive or unlisted video URLs, are disclosed externally without an explicit, informed warning at the point of use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs users to send Bilibili video links to the third-party service redfox.hk for parsing, but it does not disclose the privacy implications of transmitting user-supplied URLs and related metadata to an external provider. Even if the data seems low sensitivity, links can reveal user interests, internal references, or private/unlisted content patterns, so the lack of disclosure and consent is a legitimate privacy/security issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow explicitly encourages storing an API key in a local config file and supports a --save-key option, but it does not warn that this persists a secret to disk where it may be exposed through weak file permissions, shell history, backups, or multi-user access. This is not inherently malicious, but it is a real secret-handling weakness because users are guided to use less-safe storage without being told the risks or safer alternatives.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends user-supplied Bilibili URLs and the user's API key to redfox.hk, a third-party service, but does not clearly warn users that their inputs and credentials are being transmitted off-device. This creates a privacy and trust risk: watched/shared links may reveal user interests or sensitive internal references, and users may unknowingly expose API credentials to an external processor.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest description and all user-facing instructions are written only in Chinese, including invocation examples and operational guidance. Under the policy, a skill should not impose a specific language or locale unless it offers user choice or clearly documents a justified region/language constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The operational instructions and required output wording are specified only in Chinese, including mandatory phrasing such as the termination message and output guidance. Under the language/locale policy rule, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script's natural-language interface, help text, status messages, and output content are largely fixed in Chinese. This can violate language/locale policy when a skill forces a specific language without user opt-in or an offered alternative.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says this skill is for parsing Bilibili links and returning watermark-free download URLs. The hardcoded output promoting Redfox enterprise database procurement is not needed to download or parse videos and introduces a capability/behavior outside the stated user purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Vague Triggers

Vague Triggers

Undeclared Tool Scope

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Context-Inappropriate Capability

Static analysis