Security audit

B站视频下载

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Bilibili link parser/downloader that uses the redfox.hk API, with some privacy, credential, and copyright considerations users should understand.

Install only if you are comfortable sending Bilibili URLs to redfox.hk and using a RedFox API key. Prefer REDFOX_API_KEY in your environment over command-line keys or plaintext config files, avoid --save-key on shared or synced machines, and only download videos you are authorized to save under copyright law and platform rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 86% confidence
Finding: The skill is presented as a simple Bilibili downloader, but the documented behavior sends user-supplied URLs to a third-party service and references API key handling without clearly surfacing that external dependency as a core behavior. That mismatch can mislead users about where their data goes and what credentials are involved, increasing privacy and trust risks.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The README instructs users to invoke the skill with very broad natural-language phrases such as 'Help me save this Bilibili video' and 'Download this viral video for me.' These phrases can overlap with ordinary conversation and increase the chance of accidental or unintended invocation, which is more concerning here because the skill performs content extraction/downloading and returns short-lived direct links.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill promotes obtaining 'watermark-free direct download links' for Bilibili videos without warning users about copyright, authorization, platform terms, or other policy implications. In context, the capability is specifically oriented toward downloading and redistributing protected media, which increases the risk of misuse and may facilitate infringement at scale.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The README encourages broad natural-language use ('直接用自然语言描述需求') without clearly constraining when the skill should activate or what inputs it should refuse. In an agent ecosystem, vague trigger boundaries can cause over-invocation or misuse on loosely related requests, increasing the chance the skill processes unintended third-party URLs or bypasses user intent clarification.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill markets downloading and permanent local saving of third-party Bilibili videos, including '无水印' and '永久留存', but provides no warning about copyright, authorization, or platform terms. This materially increases the risk of facilitating infringing or policy-violating behavior because users are encouraged to save and reuse content without any compliance guardrails.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill tells users that Bilibili links are parsed via redfox.hk but does not warn that submitted URLs are sent to an external third party. Even if the URLs are not highly sensitive by themselves, user activity, research interests, or internal links pasted by mistake could be exposed outside the local environment.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The setup instructions ask the user to configure an API key for a third-party service but do not clearly warn about the trust boundary, billing/account implications, or safe credential handling. Users may unknowingly expose paid credentials or reuse sensitive tokens without understanding the external dependency.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow tells the agent to immediately send any provided Bilibili URL to the external redfox.hk service without first warning the user that their input will be transmitted to a third party. Even if the URL seems non-sensitive, video links can reveal user interests, watch targets, or private/unlisted content, so silent transmission creates a privacy and consent issue.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation recommends passing API keys on the command line and storing them in a plaintext config file under ~/.qoder/apis/redfox.json, but gives no warning about exposure through shell history, process listings, backups, or weak file permissions. This can lead to credential leakage and unauthorized use of the third-party API account.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script can persist the API key to disk in a plaintext JSON file without a clear warning at the point of use about long-term local credential storage. Even with mode 0600, plaintext secrets on disk increase exposure to local compromise, backups, terminal-sharing mistakes, and accidental inclusion in support bundles or dotfile sync tools.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.