Bilibili Toolkit Free

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.0

Overview

This is a Bilibili utility skill whose risky behavior is mostly expected for video downloading, but users should review its broad trigger wording, missing bundled implementation, and unpinned dependency installs.

Install only if you are comfortable running command-line Python tooling for Bilibili content. Use a virtual environment or container, pin dependencies yourself, confirm where downloads and subtitle/transcript files will be written, and treat the generic trigger wording as Bilibili-only rather than a general analytics tool.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:199

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 199 and 304–309
Vulnerability Type: Supply-chain risk from unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code Snippets

bash

pip install httpx aiohttp beautifulsoup4 lxml requests

markdown

| httpx | Python library | Required | `pip install httpx` |
| aiohttp | Python library | Required | `pip install aiohttp` |
| beautifulsoup4 | Python library | Required | `pip install beautifulsoup4` |
| lxml | Python library | Required | `pip install lxml` |
| requests | Python library | Required | `pip install requests` |
| faster-whisper | Python library | Optional | `pip install faster-whisper` |

Technical Analysis

The skill directs an agent to install several Python packages without pinning their versions or validating package hashes. It provides no lock file, constraints file, package integrity metadata, trusted-index restriction, or isolated-environment requirement.

Consequently, installation results depend on mutable package-index state at execution time. If a named dependency or one of its transitive dependencies publishes a compromised release, the agent may install and run attacker-controlled code. Package installation can invoke build backends or installation hooks, while malicious library code may execute when imported or used later.

This audit did not establish that any listed package is currently malicious. The confirmed issue is the unsafe dependency acquisition practice and its exposure to future compromise of direct or transitive dependencies.

Attack Path

1. An attacker compromises a listed dependency or one of its transitive dependencies and publishes a malicious release accepted by the declared version range.
2. An agent follows the setup instructions in SKILL.md.
3. pip resolves the mutable package index and selects the compromised release because no reviewed version or hash is required.
4. Attacker-controlled code executes during ...[truncated 828 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an explicitly reviewed version.
2. Generate and commit a lock or requirements file that also constrains transitive dependencies.
3. Require cryptographic hashes, such as with pip install --require-hashes -r requirements.txt.
4. Install dependencies inside a dedicated, non-privileged virtual environment or container.
5. Restrict installation to an approved package index and disable unintended extra indexes.
6. Review dependency provenance, release signatures where available, and published security advisories.
7. Add automated dependency and vulnerability scanning to release workflows.
8. Avoid instructing agents to install mutable latest releases directly from free-form Markdown commands.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger conditions say the skill should be used for generic data analysis, report generation, statistical insights, and visualization, which is much broader than the declared Bilibili-only functionality. In an agent environment, overly broad triggers can cause the skill to be invoked in unrelated contexts and then use exec-enabled workflows unnecessarily, increasing the chance of unintended command execution or file/network actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This section instructs the agent to download videos and audio to the local system but does not clearly warn that files will be written, where they will be saved, or that disk usage and overwrites may occur. In a tool-using agent with exec permission, silent local file creation is risky because a user may intend to inspect metadata only, while the skill performs persistent changes on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The subtitle and fallback transcription workflow implies local subtitle downloads and potentially additional processing via faster-whisper, but it does not clearly disclose that new files may be created or that extra model-driven processing may occur. That ambiguity is dangerous in agent settings because users may not realize the skill can write transcripts/subtitles to disk and invoke heavier secondary processing beyond simple retrieval.

Content

No source excerpt is available for this finding.