Bilibili Danmaku

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:50 AM UTC
• Version: 1.0.3

Overview

This skill is a coherent Bilibili danmaku collection and analysis tool, with ordinary dependency and output-file risks but no evidence of hidden or malicious behavior.

Install and run this only in a normal non-privileged environment, preferably after pinning dependencies or using a reviewed lockfile. Expect it to contact public Bilibili endpoints and create files under the chosen output directory. Treat generated Markdown as untrusted public-content output, especially before sharing or opening it in a renderer that loads remote images or raw HTML.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/ensure_env.sh:16

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: scripts/ensure_env.sh:16-20; requirements.txt:1-5
Vulnerability Type: Unpinned and unhashed dependency installation
Risk Level: Medium

Vulnerable Code

scripts/ensure_env.sh:16-20:

bash

echo "[info] upgrading pip/setuptools/wheel"
"$PIP" install -U pip setuptools wheel >/dev/null

echo "[info] installing requirements"
"$PIP" install -r "$REQ_FILE"

requirements.txt:1-5:

text

jieba>=0.42.1
snownlp>=0.12.3
wordcloud>=1.9.3
pillow>=10.3.0
numpy>=1.26.4

Technical Analysis

The setup script unconditionally downloads and installs the newest available versions accepted by broad lower-bound constraints. It also upgrades pip, setuptools, and wheel without pinning their versions.

No lock file, exact version constraints, package hashes, or repository restrictions are used. Consequently, the effective code installed by the setup process can change after the Skill has been reviewed. A newly compromised, malicious, or incompatible direct or transitive dependency would be accepted automatically.

Python packages can execute code during build and installation, and their modules execute code when imported. The analyzer imports jieba, snownlp, and wordcloud during normal execution. Therefore, a malicious accepted package release could obtain code execution even if installation itself did not trigger the payload.

This does not demonstrate that any currently named dependency is malicious. The vulnerability is the lack of controls needed to ensure that the reviewed dependency set is the dependency set subsequently installed.

Attack Path

1. An attacker compromises an upstream package, its publishing account, its build infrastructure, or a package in the transitive dependency graph.
2. The attacker publishes a malicious version satisfying one of the unrestricted >= constraints, or compromises a packaging-tool update.
3. A u ...[truncated 1036 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace lower-bound constraints with exact, reviewed versions for all direct dependencies.
2. Generate and commit a lock file containing the complete transitive dependency graph.
3. Record trusted distribution hashes and install with hash enforcement, for example:

   bash

   "$PIP" install --require-hashes -r requirements.lock
   

4. Pin pip, setuptools, and wheel rather than upgrading them unconditionally on every setup.
5. Use a trusted, explicitly configured package index and disable unintended extra indexes.
6. Review dependency updates before regenerating the lock file, ideally with automated vulnerability and provenance checks.
7. Run installation and analysis as a non-privileged user in a restricted environment without unrelated secrets.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/analyze_danmaku.py:287

Finding

Untrusted Danmaku Content Is Embedded into Markdown Without Sanitization

Content

View full analysis

Vulnerability Details

File Location: scripts/analyze_danmaku.py:287-296
Vulnerability Type: Markdown and HTML content injection
Risk Level: Low

Vulnerable Code

python

f.write("### Positive examples\n")
if top_pos:
    for t, s in top_pos[:5]:
        f.write(f"- ({s:.3f}) {t}\n")
else:
    f.write("- None\n")

f.write("\n### Negative examples\n")
if top_neg:
    for t, s in top_neg[:5]:
        f.write(f"- ({s:.3f}) {t}\n")

The audited source uses localized section labels, but the security-relevant operations are the two verbatim interpolations of t into the generated Markdown report.

Technical Analysis

The variable t originates from public Bilibili danmaku text. The fetched text is parsed from XML, stored in CSV, loaded by the analyzer, and then inserted directly into a Markdown document without escaping Markdown metacharacters, removing raw HTML, or restricting links and images.

A crafted comment can therefore alter the rendered structure of the report. Depending on the Markdown renderer, payloads may introduce headings, links, images, raw HTML, or misleading report sections. A remote image reference can cause a report viewer to contact an attacker-controlled server, revealing viewer network metadata such as the source IP address, request time, and user-agent string.

Inclusion in the report depends on the comment being selected among the highest positive or lowest negative sentiment examples. An attacker can attempt to influence this selection by constructing highly polarized text while including the Markdown payload.

Attack Path

1. An attacker submits a crafted public danmaku containing Markdown or HTML syntax to a target Bilibili video.
2. The operator fetches that video's danmaku using fetch_danmaku.py.
3. The attacker crafts the surrounding wording to obtain an extreme SnowNLP sentiment score.
4. The analyzer selects the comment for top_pos or top_neg ...[truncated 899 chars]

Remediation

View remediation

Remediation Suggestions

1. Escape Markdown control characters in every untrusted comment before writing it to the report.
2. Remove or neutralize raw HTML, inline links, image syntax, and autolinks.
3. Prefer displaying comments in sanitized fenced code blocks or another literal-text representation.
4. Normalize embedded line breaks so a comment cannot terminate its list item and create new report sections.
5. Configure the intended Markdown renderer to disable raw HTML and remote-resource loading.
6. Preserve the original comment separately in structured JSON if exact source text is required for analysis, while using only a sanitized representation in the human-readable report.
7. Add tests containing headings, links, images, raw HTML, multiline payloads, and escaped delimiters to verify that generated reports retain their intended structure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code chunk is a thin wrapper around an analysis script. Its concrete behavior is to require a local CSV input, optionally pass along metadata, and run a Python script in a virtual environment. That aligns partially with the analysis portion of the description, but the declared end-to-end purpose explicitly includes fetching danmaku from a Bilibili video URL/BVID, which is not implemented in this chunk. Because the primary exposed interface and capability in the code are local-file analysis rather than URL/BVID-based fetching, the description overstates what this supplied code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The code's core functionality is limited to retrieval and export of Bilibili danmaku data. It calls Bilibili APIs to resolve video metadata/CID, downloads danmaku XML, parses each comment, and writes structured outputs to files. The declared description promises downstream analytical capabilities—keyword frequency, word cloud creation, sentiment analysis, and opinion reporting—but none of these are implemented in the supplied code. This is a material description-behavior mismatch because the primary purpose described is analysis/reporting, while the actual code is only a data collection/export utility.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

- `requirements.txt`：Python依赖清单

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill documentation instructs the agent to run scripts that read and write local files and fetch data from the network, but it declares no explicit tool scope or permission boundaries. In an agent environment, this can lead to over-broad execution authority, making accidental or unauthorized file and network access more likely if the skill is auto-invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger guidance is broad ('use when the user asks to analyze B站弹幕, generate 词云图, run 情感分析, or produce 舆情分析') and lacks clear activation limits. In agent systems, vague triggers can cause inappropriate or premature invocation of a network- and file-capable skill on loosely related requests, expanding the chance of unnecessary external access or unintended processing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest says the skill outputs an SVG word cloud, but this documentation states it generates a high-density PNG word cloud for direct sending. That is a direct semantic mismatch between the skill's stated behavior and its documented implementation/output format.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This plain-text file consists of generic everyday Chinese phrases such as "给我", "可以", and "需要" without any scope notes, exclusions, or context. If this list is used to influence skill activation or suppression, these broad terms overlap heavily with normal user speech and could cause unintended behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file contains user-facing natural-language text that forces a specific language/locale for core usage, including the module docstring and later command-line help and status messages. Under the policy, language constraints should either be optional or clearly justified; here no opt-in or alternative locale is offered.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a skill that fetches danmaku and outputs analysis artifacts such as keyword frequency, word clouds, sentiment distribution, and a public-opinion report. This script instead persists the full raw comment corpus and metadata as CSV/JSON/TXT files, which is a broader data-export capability not reflected in the stated skill description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest claims the skill will analyze danmaku and output keyword frequency, SVG word cloud, sentiment distribution, and a public-opinion report. In this file, the main flow only resolves video metadata, downloads XML danmaku, parses it, and writes raw records/metadata to disk; none of the promised analysis artifacts are generated here.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fetch_danmaku.py (reported line 220)May include surrounding context.

python

if bvid:
            video_meta["bvid"] = bvid
    else:
        api = f"https://api.bilibili.com/x/web-interface/view?bvid={urllib.parse.quote(bvid)}"
        view = http_get_json(api)
        if view.get("code") != 0:
            print(f"[error] 获取视频信息失败: {view}", file=sys.stderr)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file documents that runtime artifacts are written to output/ and later lists several generated files, but it does not include an explicit user warning about filesystem side effects such as creating or potentially replacing local outputs. For a skill that fetches data and generates reports, a brief disclosure about local file creation would improve user awareness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file contains user-facing instructional content only in Chinese, which can amount to a language/locale policy violation when no opt-in or alternative language is provided. The file does not state that it is intended only for a Chinese-language or region-specific audience.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with a lower bound only, which allows future unreviewed versions to be installed and makes builds non-reproducible. While not an immediate exploit by itself, it increases supply-chain risk because vulnerable or breaking releases could be pulled in later without notice.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

jieba>=0.42.1
snownlp>=0.12.3
wordcloud>=1.9.3
pillow>=10.3.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Using an unpinned version range for this package permits installation of different versions over time, reducing reproducibility and increasing exposure to supply-chain issues. If an upstream release introduces a vulnerability or malicious compromise, the environment may silently consume it.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

jieba>=0.42.1
snownlp>=0.12.3
wordcloud>=1.9.3
pillow>=10.3.0
numpy>=1.26.4

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

A minimum-version requirement without an exact pin allows dependency drift, which can pull in untested or vulnerable upstream releases. This creates a real but low-severity supply-chain weakness rather than a direct code flaw in the skill itself.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

jieba>=0.42.1
snownlp>=0.12.3
wordcloud>=1.9.3
pillow>=10.3.0
numpy>=1.26.4

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Pillow is unpinned despite a history of security advisories, so the actual installed version may vary and could include a vulnerable release. In this skill, image generation for word clouds increases the relevance of Pillow because malformed image/font handling bugs can become reachable during normal operation.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

jieba>=0.42.1
snownlp>=0.12.3
wordcloud>=1.9.3
pillow>=10.3.0
numpy>=1.26.4

Unverifiable Dependency: pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Because Pillow is not pinned, it is impossible to verify whether the installed version is affected by any of its known CVEs. This matters more in this skill than in a purely text-only tool, since Pillow is likely exercised when generating the SVG/word-cloud related output pipeline or any raster/font processing around it.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The unpinned NumPy dependency makes installations non-deterministic and may allow deployment of versions with known defects or future supply-chain compromise. In this context it is less directly exposed than image-handling libraries, but still represents a real dependency hygiene issue.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

snownlp>=0.12.3
wordcloud>=1.9.3
pillow>=10.3.0
numpy>=1.26.4

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

NumPy has known advisories, and without a pinned version there is no assurance that deployment avoids affected releases. Although the skill’s primary function is text analysis rather than dangerous native processing, dependency ambiguity still creates avoidable supply-chain and stability risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The module docstring is entirely in Chinese and the CLI help/messages throughout the script are also Chinese-only, which imposes a specific language on users by default. The file does not indicate that the tool is region-specific or provide any opt-in or alternative locale, matching the language-policy concern for natural-language content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This shell script includes natural-language guidance only in Chinese for the usage comments, which imposes a specific language on users without offering a choice. The policy for this audit flags language or locale constraints when they are not optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.