bilibili-toolkit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:26 AM UTC
• Version: 1.0.2

Overview

This skill is a Bilibili automation guide, but it asks for powerful account credentials and command execution while relying on missing, unverifiable implementation code.

Review before installing. Only use this with a trusted, auditable implementation of bilibili_toolkit_pro, avoid persisting SESSDATA or bili_jct unless necessary, use a separate low-privilege environment, and treat the Bilibili cookies as full account session secrets capable of account actions if exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:250

Finding

Unpinned Third-Party Dependencies Installed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 250-255
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: Medium

Vulnerable Code

markdown

| httpx | Python library | Required | `pip install httpx` |
| aiohttp | Python library | Required | `pip install aiohttp` |
| beautifulsoup4 | Python library | Required | `pip install beautifulsoup4` |
| lxml | Python library | Required | `pip install lxml` |
| requests | Python library | Required | `pip install requests` |
| faster-whisper | Python library | Optional | `pip install faster-whisper` |

The labels in this excerpt are translated into English, while the package names and installation commands reproduce the audited instructions.

Technical Analysis

The Skill instructs users or AI agents to install multiple Python packages directly by name. It does not specify reviewed versions, package hashes, a lockfile, an approved package index, or signature verification.

Consequently, the effective dependency code can change after the Skill has been reviewed. A compromised future release, dependency account takeover, malicious transitive dependency, or unsafe package-index configuration could introduce arbitrary code into the execution environment.

This is a supply-chain weakness rather than evidence that any currently named package is malicious. No malicious dependency was confirmed during the audit.

Attack Path

1. An attacker compromises a listed dependency, one of its transitive dependencies, or the package-resolution infrastructure.
2. A user or agent follows the documented unpinned pip install command.
3. The package manager resolves and installs an attacker-controlled release.
4. Malicious code executes during installation, import, or normal package use.
5. That code accesses data available to the process, potentially including Bilibili credentials, local media, and account-operation parameters ...[truncated 498 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed version.
2. Generate a lockfile that also fixes all transitive dependency versions.
3. Require package hashes, such as through pip install --require-hashes.
4. Install exclusively from a configured and trusted package index.
5. Perform dependency vulnerability and provenance checks in CI.
6. Run the toolkit in an isolated virtual environment or container under a dedicated, least-privileged account.
7. Document a controlled upgrade process in which dependency changes are reviewed and tested before release.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:144

Finding

Sensitive Session Credentials Are Delegated to an Unavailable and Unverifiable Implementation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 54 and lines 144-152
Vulnerability Type: Unsafe and unverifiable credential handling
Risk Level: High

Vulnerable Code

python

from bilibili_toolkit_pro import BilibiliAllInOne

python

import os
os.environ["BILIBILI_SESSDATA"] = "your_sessdata"
os.environ["BILIBILI_BILI_JCT"] = "your_bili_jct"
os.environ["BILIBILI_BUVID3"] = "your_buvid3"

app = BilibiliAllInOne(
    sessdata="your_sessdata",
    bili_jct="your_bili_jct",
    buvid3="your_buvid3",
    persist=True
)

Technical Analysis

The Skill requests SESSDATA, bili_jct, and buvid3, including a full browser session credential and a CSRF token. It then passes these values to BilibiliAllInOne and supports persistent storage through persist=True.

However, the project contains only SKILL.md. The imported bilibili_toolkit_pro module and the separately referenced bilibili_toolkit_pro.py script are absent. The audit therefore cannot verify:

• Where persisted credentials are stored.
• Whether restrictive file permissions are actually enforced.
• Whether secrets are logged or included in error messages.
• Whether network requests are restricted to official Bilibili endpoints.
• Whether credential files resist symbolic-link or race-condition attacks.
• Whether credentials are deleted securely when persistence is cleared.

The documentation claims that persisted files use mode 0600 and that credentials are sent only to official Bilibili domains, but no implementation is present to substantiate those claims. Because these credentials may authorize account-level operations such as publishing and editing videos, entrusting them to unavailable code creates a high-impact security boundary.

No direct credential exfiltration, malicious endpoint, or embedded implementation was found in the audited project. The confirmed issue is that sensitive credential han ...[truncated 1485 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete implementation in the project so that credential storage, network behavior, and deletion logic can be audited.
2. If the implementation must remain external, provide a canonical source, immutable version, cryptographic checksum, signed release, and reproducible installation procedure.
3. Avoid full browser-session cookies when Bilibili offers scoped or revocable authorization mechanisms.
4. Keep persistence disabled by default and require explicit, informed user consent before writing credentials to disk.
5. Store secrets outside the project directory using an operating-system credential manager or dedicated secret-management service.
6. If file storage is unavoidable, create files atomically, reject symbolic links, enforce owner-only access before writing, and verify effective permissions after creation.
7. Redact credentials from logs, exceptions, command histories, telemetry, and serialized configuration.
8. Enforce a strict HTTPS endpoint allowlist for official Bilibili hosts and validate redirects so credentials cannot be forwarded to third-party domains.
9. Add automated tests verifying storage permissions, endpoint restrictions, secret redaction, credential deletion, and persistence behavior.
10. Document credential revocation and incident-response steps for users who suspect exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill name, summaries, descriptions, examples, and Q&A are written entirely in Chinese, and the examples also hardcode Chinese locale content such as language="zh-CN" and Beijing time formatting. There is no indication that the user may choose another language or that the skill is intentionally restricted to Chinese-speaking or China-specific contexts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is presented as a Bilibili operations toolkit, but its documentation advertises unrelated vulnerability scanning, CVE correlation, and security audit features. This capability mismatch is dangerous because it can mislead an agent or user into invoking broader security-sensitive behaviors than expected, increasing the chance of unsafe exec use, over-privileged operation, or deceptive repurposing of the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly supports persisting active Bilibili session credentials to disk, but does not prominently warn that SESSDATA/bili_jct are full browser-session secrets that can enable account actions if stolen. In a skill with read/write/exec permissions, credential persistence materially increases compromise impact through local file exposure, backup leakage, accidental commits, or misuse by other processes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented input/output contract describes a generic review-and-scoring workflow rather than Bilibili publishing, downloading, or analytics operations. This inconsistency is risky because agents may trust the declared contract when routing data or deciding tool usage, leading to confused-deputy behavior, mishandling of sensitive inputs, or execution of unintended logic under a misleading interface.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill claims credentials are sent only to official Bilibili domains and not shared with third parties, yet other sections require LLM/API-key integrations unrelated to Bilibili-only operation. This contradiction is dangerous because users may disclose active session cookies under false assumptions about data flow, creating a real risk of credential exposure to external services, logging systems, or unintended components.

Content

No source excerpt is available for this finding.