Bili Rs

Development skill for bili-rs, a Rust CLI tool for Bilibili (B站). Use when implementing features, fixing bugs, or extending the bilibili-cli-rust codebase. P...

Security Scan

This is a developer guidance skill for a Rust Bilibili CLI; its instructions, referenced APIs, and conventions are consistent with that purpose and it does not ask for unrelated credentials or install code.

Purpose & Capability

The skill is presented as a development/reference guide for the bili-rs project and all included material (architecture rules, command list, API endpoints, payload helpers) matches that stated purpose. It does not request unrelated binaries, credentials, or system access in the metadata.

Instruction Scope

SKILL.md and references are purely developer guidance (where to add files, error handling patterns, output envelopes, etc.). They reference a credential file (~/.bilibili-cli/credential.json), authentication tokens (SESSDATA, bili_jct), an $OUTPUT env var, and WBI signing logic — all sensible for a Bilibili client, but these are project conventions rather than explicit runtime requirements. The instructions do not tell the agent to read arbitrary system files or exfiltrate data, but they do describe where credentials would be stored/used if the developer implements auth features.

Install Mechanism

There is no install spec and no code files to be written or executed by the platform; this is instruction-only, which minimizes install-time risk.

Credentials

The skill does not declare or require any environment variables or secrets in its metadata. However, the documentation discusses Bilibili auth tokens (SESSDATA, bili_jct), a credential file path, and output-resolution via $OUTPUT — all appropriate for a Bilibili CLI but worth noting because providing such secrets to the agent or test environment would grant access to a user account and write-capable operations (likes, coins, dynamics, etc.).

Persistence & Privilege

The skill is not marked 'always: true' and uses the platform defaults for invocation. It does not request modification of other skills or system-level settings.

Assessment

This skill is a codebase-style reference for building a Rust Bilibili CLI and appears internally consistent. It does mention where the CLI would store credentials and which API calls require SESSDATA/bili_jct; do not provide those secrets to the agent unless you intend it to act on your Bilibili account. If you plan to implement/write features that perform 'write' operations (like/coin/unfollow/dynamic-post), test in a disposable or test account. Because this is instruction-only, review any actual source code you add or run locally before executing network calls; the SKILL.md itself does not request unusual privileges, but real risk arises if you run code that uses the described credentials.

bili-rs Development Skill

Rust rewrite of bilibili-cli. Single binary, no runtime deps. Full feature parity with the Python original.

Architecture (strict layering)

cli/ (clap structs only)  →  commands/ (business logic)  →  client/ (HTTP async fn)
                                      ↓
                               payloads/ (normalize raw JSON → structs)
                                      ↓
                               formatter.rs (JSON/YAML/Rich output)

Rules:

• cli/ — clap derive structs only, zero business logic
• commands/ — calls client/, never builds HTTP requests directly
• client/ — never imports clap or formatter

Adding a New Command

1. Add clap struct in src/cli/<domain>.rs
2. Add handler in src/commands/<domain>.rs
3. Add API call(s) in src/client/<domain>.rs
4. Add payload normalizer in src/payloads/<domain>.rs if needed
5. Wire into src/main.rs run() match arm

Key Patterns

Error handling

// client/ layer: always map API errors
let code = body["code"].as_i64().unwrap_or(-1);
if code != 0 {
    return Err(map_api_error(code, body["message"].as_str().unwrap_or("unknown")));
}

// commands/ layer
match result {
    Ok(data) => formatter::output(data, format),
    Err(e) => { emit_error(&e, format); std::process::exit(1); }
}

Output envelope (never change the field names)

SuccessEnvelope { ok: true, schema_version: "1", data: T }
ErrorEnvelope   { ok: false, schema_version: "1", error: ErrorBody }

Output format resolution

--json > --yaml > $OUTPUT env var > TTY→Rich / non-TTY→YAML

Authentication levels

• Optional — load saved creds if available, don't fail if missing
• Read — requires SESSDATA
• Write — requires SESSDATA + bili_jct

Credential file: ~/.bilibili-cli/credential.json (0o600, 7-day TTL)

WBI Signature

Some Bilibili endpoints require a WBI request signature (a per-request HMAC-like parameter). Use src/client/wbi.rs:

let (img_key, sub_key) = fetch_wbi_keys(cred).await?;
let params = sign_params(vec![("bvid".to_string(), bvid)], &img_key, &sub_key);
req = req.query(&params);

Known endpoints needing WBI: /x/web-interface/view/conclusion/get

Output & Terminal

• Status/errors → stderr with console::style
• Data → stdout as table (comfy-table) or JSON/YAML
• Counts ≥ 10000 → "X.X万" format

Quality Gate (run before every commit)

cargo build && cargo clippy -- -D warnings && cargo fmt --check && cargo test

References

• All CLI commands & options: See references/commands.md
• API endpoints & payloads: See references/api.md
• Full project spec: PRD.md in project root
• Implementation conventions: CLAUDE.md in project root