ClawHub
Back to skill

Security audit

B站创作助手免费版

Security checks for vulnerabilities and agentic risk

Overview

This Bilibili content helper is not clearly malicious, but it asks for command execution and file-writing authority that does not fit its stated pure-text content-generation purpose.

Review this before installing. The core idea is a normal content-writing helper, but the requested exec and write permissions are broader than necessary and the documentation is inconsistent about whether commands or files are involved. Prefer a version that removes exec/write or documents a specific bundled command, strict command scope, and any file-writing behavior.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill’s stated purpose is narrow content generation for B站 titles, descriptions, and tags, but the documentation broadens behavior into generic create/query/modify/delete and save/export/import operations. This mismatch increases attack surface and can cause an agent to perform unintended actions outside the user’s expected scope, especially when paired with tool access.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill declares write capability even though its own description says outputs are pure text for users to copy manually. Unnecessary write access violates least privilege and could let the agent save, overwrite, or persist data without a clear product need, making misuse or prompt-induced file modification more dangerous.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The documentation asserts the skill is pure Markdown and does not require exec, yet the manifest grants exec and examples instruct shell command use via bili.sh. This contradiction is dangerous because users and orchestrators may trust the lower-risk description while the skill retains command-execution capability, enabling unintended or attacker-influenced process execution.

Static analysis

No suspicious patterns detected.