Security audit

Bilibili Downloader

Security checks for vulnerabilities and agentic risk

Overview

This Bilibili downloader appears purpose-aligned, but it needs Review because it handles session cookies and writes remote-content-based filenames without enough safety guidance or safeguards.

Review before installing. Use a virtual environment, pin and review the bilibili-api-python dependency, keep BILIBILI_SESSDATA out of code and tracked config files, treat that cookie like a password, and download only into a dedicated directory with enough disk space. Be cautious on Windows or shared systems because remote video titles can influence output filenames.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/download_config.json:7
Finding: Configuration Encourages Plaintext Session-Cookie Storage
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/download_video.py:17
Finding: Incomplete Sanitization of Remotely Supplied Output Filenames
Content: View full analysis
Remediation: View remediation
str: value = re.sub(r"[^A-Za-z0-9._ -]", "_", value) value = value.strip(" .") return value[:50] or fallback base = Path(output_path).resolve() candidate = (base / f"{safe_component(title)}.mp4").resolve() if base not in candidate.parents: raise ValueError("Output path escapes the download directory") ``` 6. Avoid overwriting existing files by default, or require explicit confirmation. 7. Add tests for Windows and POSIX traversal strings, reserved device names, control characters, and excessively long metadata. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code’s primary behavior is specifically downloading every video in a Bilibili playlist/series by playlist ID and saving them as MP4 files. That is broadly related to Bilibili downloading, but the declared description presents a more general downloader focused on individual content types such as videos, audio, subtitles, danmaku, and covers. This chunk does not implement those additional capabilities and instead adds a specific playlist-bulk-download behavior that is not clearly stated in the description. Therefore the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broader multi-format Bilibili downloading capability, including audio, subtitles, danmaku, covers, and download preference management. The actual code chunk is much narrower: it instantiates a bilibili_api video object, fetches metadata for the title, and downloads a single video file to disk, optionally using a specified quality. This is aligned with part of the description (video downloading in various qualities), but it does not implement most of the other declared capabilities. Additionally, the script usage claims it accepts a BVID or URL, but the implementation passes the first argument directly as bvid to video.Video, so URL handling is not shown. Therefore the description overstates what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: The code is clearly related to the declared Bilibili downloading purpose, so there is strong alignment at a high level. However, the declared description explicitly includes downloading audio and danmaku, while this code only downloads the video, cover, and subtitles. It also supports configuration such as output directory and default quality. There is no evidence of unrelated behavior or undeclared sensitive access. The mismatch is therefore an overstatement of capabilities in the description relative to the supplied code chunk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The authentication section instructs users to export a live session cookie into an environment variable without warning that it is a sensitive credential equivalent to account access. If exposed through shell history, logs, process listings, or agent telemetry, the cookie could be reused to access the user's Bilibili account and premium content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The guide instructs users to place a live Bilibili session cookie (SESSDATA) into an environment variable or directly into code, but gives no warning that this value is a sensitive credential equivalent to account access. In a downloader skill context, users are likely to copy/paste real session tokens, increasing the chance of credential leakage through shell history, source control, logs, screenshots, or shared scripts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest describes downloading videos, audio, subtitles, covers, and related assets from Bilibili, but does not mention playlist or series bulk-download functionality. This file specifically enumerates all videos in a playlist and downloads them in sequence, expanding the skill’s operational scope beyond the described per-item download behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill encourages writing downloaded media to local paths but does not warn users or agents that running it will modify local storage and may consume significant disk space. In an agent setting, this can lead to unintended filesystem changes, overwriting files, or storage exhaustion if invoked without adequate notice or path controls.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The file's natural-language instructions are entirely in Chinese and do not indicate that the skill is region-specific or provide an alternative language option. Per SQP-3, forcing a specific language without user opt-in can be a language/locale policy concern when no justification or choice is given.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This JSON manifest includes natural-language labels such as "杜比视界" alongside English labels, effectively fixing part of the user-facing configuration to a specific locale without any documented opt-in or alternative. The policy requires flagging language or locale constraints when no user choice is offered.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This code fetches playlist metadata and video download URLs from a remote service and writes downloaded media files to disk, but it only documents usage and progress. There is no explicit warning that running the script will contact Bilibili and save multiple files locally, which is a safety-relevant side effect for a downloader script.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.