Bilili-downloader
v1.0.3Download Bilibili videos. You MUST ask the user for the Bilibili URL first. Then use the provided python script to download. Supports batch/playlist downloading.
⭐ 6· 2.7k·10 current·11 all-time
byDong Chao@caiyundc880518
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, SKILL.md, requirements.txt, and the Python script all align: they implement a Bilibili downloader and declare the expected dependencies (python, yt-dlp, ffmpeg). No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
SKILL.md confines runtime actions to asking the user for a URL and running the provided script. The instructions do not ask the agent to read unrelated files or exfiltrate data. A minor note: SKILL.md mentions cookies for VIP/region-locked content but doesn't provide an explicit mechanism for supplying cookies (not a security problem but could affect functionality).
Install Mechanism
This is instruction-only (no install spec). That is lower-risk, but requirements.txt names yt-dlp which must be installed separately; the skill expects yt-dlp available on PATH. No remote downloads or extract/install steps are present in the package.
Credentials
The skill requests no environment variables, tokens, or credentials. The note about cookies is informational only; the code does not attempt to read secrets from environment/config paths.
Persistence & Privilege
always is false and the skill does not request persistent/privileged presence or attempt to modify other skills or system-wide settings. It runs as an on-demand helper that invokes external yt-dlp.
Assessment
This skill appears to do what it says, but review and precautions before installing: (1) Verify you trust the author/source because the script will run commands that access the network (yt-dlp will contact Bilibili); (2) Install yt-dlp and ffmpeg yourself (requirements.txt lists yt-dlp); the skill assumes yt-dlp is on PATH; (3) The downloader writes files to the working directory (or specified output); ensure sufficient disk space and that you are comfortable with files being created there; (4) If you need to download VIP/region-locked content you may need to supply cookies—decide whether and how you provide those (do not paste secrets into untrusted UIs); (5) Consider running the script in a restricted/sandboxed environment if you are unsure about running third-party code; (6) Be aware of copyright and Bilibili terms of service—use only for permitted personal backups or learning. Overall the package is coherent and contains no obvious data-exfiltration or unrelated privilege requests.Like a lobster shell, security has layers — review code before you run it.
latestvk970y3qv9xmxj4zpkqmyp6w5sx80vnx2
License
MIT-0
Free to use, modify, and redistribute. No attribution required.