Security audit

B站创作助手专业版

Security checks for vulnerabilities and agentic risk

Overview

This Bilibili content skill is not malicious, but it asks for broad file, command, and API capabilities that are not tightly scoped to its creative-writing purpose.

Review this skill before installing. It appears intended for Bilibili content workflows, but only use it where you are comfortable granting file read/write, command execution, and possible public API/network use; avoid giving it access to unrelated private files or credentials.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill is presented as a Bilibili content-creation assistant, but it also advertises generic file processing capabilities that are not tightly scoped to that purpose. Expanding a creative skill into broad read/write handling increases the chance of unintended access to unrelated local files, especially when paired with broad trigger conditions and no clear file-scope restrictions.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Declaring generic system command execution as a core function is dangerous because the skill's stated business purpose does not require unconstrained shell access. In an agent environment with exec enabled, this creates a path for command injection, unsafe subprocess use, or abuse of the host system beyond content-generation tasks.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The documented external API integration is broader than the skill's stated creative-assistant role and lacks clear boundaries on what services may be contacted or what data may be sent. This increases the risk of unauthorized data egress, privacy issues, or use of untrusted third-party endpoints under the guise of normal skill behavior.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger conditions are overly broad, causing the skill to activate for generic writing, marketing, and optimization requests rather than narrowly scoped Bilibili workflows. Overbroad activation increases the chance that the agent will invoke a higher-privilege skill unexpectedly, exposing file, network, or exec capabilities in contexts where they are unnecessary.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill advertises file writing, command execution, and external/API usage without prominent user-facing warnings about the resulting system and data impact. In practice, this can mislead users into invoking a content tool that may modify files, run commands, or contact external services, increasing the risk of accidental system changes and data leakage.

Static analysis

No suspicious patterns detected.