Security audit

bilibili-toolkit

Security checks for vulnerabilities and agentic risk

Overview

This Bilibili automation skill requests sensitive account credentials and account-changing authority while mixing in unrelated audit/LLM claims, so it should be reviewed carefully before installation.

Install only if you are comfortable giving an agent command execution, file access, and Bilibili account-changing capability. Treat SESSDATA and bili_jct like passwords, avoid persistence unless necessary, do not send them to LLMs or unrelated tools, and require manual confirmation before any upload, edit, draft, or scheduled publish action.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

High

Confidence: 91% confidence
Finding: The skill is presented as a Bilibili operations toolkit, but it also advertises unrelated vulnerability scanning, CVE correlation, threat intelligence, and security audit features. This kind of capability mixing is dangerous because it obscures the real scope of the skill and can cause an agent or user to authorize execution paths and data handling that are unrelated to the stated purpose.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The documented input/output contract describes a generic LLM-based audit and scoring system rather than video publishing/downloading operations. This mismatch can mislead orchestration layers into passing arbitrary content for analysis or trusting outputs that do not correspond to the stated tool, increasing the risk of unintended data exposure and unsafe execution behavior.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The dependency section says the skill requires an LLM for intelligent review, which contradicts the described Bilibili toolkit behavior. This inconsistency broadens the apparent trust boundary and suggests data may be routed to external model providers even when users expect only Bilibili interactions.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The document claims that no data is shared with third parties, while other sections indicate use of external LLM APIs. False or contradictory disclosure about data flows is dangerous because users may provide full session cookies or operational data under incorrect assumptions about where that data will be transmitted.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The skill description is overly broad and lacks clear activation boundaries, reading more like a general capability catalog than a narrowly scoped tool. In an agent context, vague scope increases the chance of overbroad invocation, privilege misuse, and user misunderstanding about what actions may be taken.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill supports upload, scheduling, editing, and other write operations that can change account state, but it does not provide a prominent warning or confirmation requirement. In an agent setting, this can lead to accidental publication, edits, or other irreversible actions on behalf of the user.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation instructs users to extract and reuse full browser session cookies without a strong, prominent warning about the sensitivity of those credentials. These values are effectively account takeover secrets for authenticated operations, and normalizing their manual extraction materially increases the risk of leakage, reuse, and abuse.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill explicitly tells users to copy full browser session cookies such as SESSDATA and bili_jct for automated use. Handling full authenticated session material in this way is dangerous because those secrets can be exfiltrated, persisted insecurely, accidentally logged, or forwarded to other tools, enabling unauthorized account actions including publishing and editing content.

Static analysis

No suspicious patterns detected.