bilibili-helper-free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:25 AM UTC
• Version: 1.0.3

Overview

The skill is a Bilibili text-generation helper, but it asks for broad file and command authority that is not needed for that purpose.

Review this skill before installing. Its core copywriting features are ordinary, and no destructive payload was found, but it requests and documents broad command and file capabilities that are unnecessary for basic Bilibili text generation. Only use it in a sandboxed agent environment, avoid granting exec or write unless you explicitly need them, and do not run any bili.sh command unless you have independently verified the script and its path.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:31

Finding

Excessive Filesystem and Command-Execution Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–34
Vulnerability Type: Violation of least privilege through unnecessary tool permissions
Risk Level: Medium

Vulnerable Code

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The Skill declares unrestricted reading, writing, and command-execution capabilities even though its stated purpose is limited to generating titles, descriptions, tags, and narration scripts through an LLM. Those content-generation functions do not inherently require filesystem access or operating-system command execution.

The requested capabilities substantially increase the Skill's authority:

• read may permit access to local files available to the Agent.
• write may permit modification or creation of files.
• exec may permit execution of operating-system commands under the Agent process's account.

The document later advertises generic file processing and command execution, but the package contains no implementation that demonstrates a legitimate need for these privileges. This breaks the principle of least privilege and increases the consequences of malicious user input, prompt injection in processed content, or future modifications to the Skill instructions.

Attack Path

1. A host loads the Skill and grants the tools declared in its metadata.
2. An attacker supplies crafted task input or content containing instructions that induce the Agent to perform actions unrelated to Bilibili text generation.
3. The Agent invokes read to access local data, write to alter files, or exec to run commands.
4. The resulting access occurs with the filesystem permissions and operating-system privileges of the Agent process.

This path depends on the host granting the declared tools and the Agent being induced to misuse them; the audited file does not contain an autonomous exploitation payload.

Impact Assessment

Successful exploitati ...[truncated 361 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove read, write, and exec from the declared tools because the documented text-generation workflow does not require them.
2. Use no external tools when the host LLM can generate the requested content directly.
3. If a future implementation requires a tool, grant only the narrowest capability needed. Restrict filesystem operations to a dedicated workspace and use an allowlisted command interface instead of a general shell.
4. Require explicit user confirmation before any filesystem modification or command execution.
5. Enforce host-side sandboxing, path restrictions, command allowlists, execution timeouts, and output-size limits.
6. Add tests verifying that ordinary title, description, tag, and script generation never invokes filesystem or execution tools.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:52

Finding

Unqualified Execution of an Absent Shell Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52–59
Vulnerability Type: Unsafe executable resolution through the ambient search path
Risk Level: Medium

Vulnerable Code

bash

bili.sh title "video topic"
bili.sh desc "video topic"
bili.sh script "video topic" --length 5|10|15
bili.sh tags "video topic"
bili.sh help

The displayed argument text is translated into English for report consistency; the audited commands use an equivalent non-English phrase meaning “video topic.”

Technical Analysis

The documentation directs users or Agents to invoke bili.sh by its bare executable name. The audited project contains only SKILL.md; it does not include a bili.sh implementation and does not identify a trusted installation source, expected absolute path, version, or integrity hash.

When a shell executes a bare command name, it commonly resolves that name through the process's PATH. Consequently, the command that runs is determined by the surrounding environment rather than by a verified artifact in this package. An attacker who can place a malicious executable named bili.sh in an earlier searched directory could cause their program to execute when a user follows the documentation.

The pipe characters in --length 5|10|15 are also unsafe as a literal shell example. In common shells, unquoted pipe characters create pipelines rather than expressing a choice among allowed values. This can produce unintended command execution attempts and makes the documented interface unreliable.

No malicious bili.sh payload was found in the project. The issue is an unsafe and unverifiable execution instruction, not confirmed embedded malware.

Attack Path

1. An attacker gains the ability to create a file in a directory that appears early in the victim's PATH, or influences the PATH used by the Agent.
2. The attacker creates an executable named bili.sh in that directory.
3. A user or Agen ...[truncated 824 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the shell command examples if the Skill is intended to operate entirely through natural-language Agent instructions.
2. If a command-line implementation is required, include the reviewed script in the package and invoke it through a verified project-relative or absolute path rather than through ambient PATH lookup.
3. Publish the script's trusted source, version, cryptographic checksum, and installation procedure.
4. Verify ownership and permissions of the executable before invocation and reject writable or untrusted executable locations.
5. Replace --length 5|10|15 with separate safe examples or a placeholder that cannot be interpreted as a shell pipeline, such as --length 5.
6. Avoid general shell execution where possible. Use a structured process API with a fixed executable path and an argument array.
7. Add packaging tests that fail when documented executable files are absent from the distributed project.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Documenting command execution for a basic title/description/script generator introduces an unnecessary high-risk primitive. If wired to an agent runtime, this can enable arbitrary shell execution, data exfiltration, environment inspection, or destructive local actions far beyond the stated Bilibili assistance purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The file claims the free version cannot generate cover images, reinforcing a narrow feature set, but elsewhere advertises broad file/API/command capabilities. This contradiction can mislead users and reviewers into underestimating what the skill can actually do, weakening trust boundaries and review accuracy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The FAQ states that the skill only supports Chinese content generation and does not support English or other languages. This is a natural-language locale restriction presented as a hard limitation without user opt-in or a clearly documented policy justification, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a narrow Bilibili copywriting helper, but later documentation expands it into generic file handling, API access, command execution, and information retrieval. This capability mismatch is dangerous because users and policy layers may approve or invoke it under a low-risk mental model while it actually exposes broader system and data access surfaces.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises file I/O, API calls, and command execution without concrete warnings about system modification, data exposure, or outbound transmission. In practice, this deprives users and operators of informed consent and increases the chance of unsafe invocation in sensitive environments.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Generic file read/write capability is broader than needed for producing Bilibili text suggestions. In an agent environment, this can expose local secrets, overwrite user files, or be combined with prompt-driven abuse to stage persistence or exfiltrate sensitive content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

External API integration adds a network egress channel that is not clearly necessary for a basic local-seeming copywriting helper. This increases the risk of sending user prompts, local data, or derived content to third parties without adequate disclosure or scope control.

Content

No source excerpt is available for this finding.