ClawHub
Back to skill

Security audit

Yq Bilibili Skill

Security checks across malware telemetry and agentic risk

Overview

This Bilibili skill is useful and mostly coherent, but it can silently use saved/browser login sessions and perform account-changing actions without clear consent safeguards.

Review before installing. Prefer QR login over browser-cookie reuse, verify the bilibili-cli package source and version, and instruct your agent to ask before reading private account data or running like, coin, triple, unfollow, or any other account-changing command.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill description is extremely broad and overlaps with many normal Bilibili-related user requests, increasing the chance the agent invokes this skill when the user did not explicitly intend account-linked or side-effecting operations. In this skill, that risk is amplified because the same skill includes authenticated reads and write actions such as like, coin, triple, and unfollow.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation exposes account-modifying commands such as liking, coin spending, triple actions, and unfollow without an explicit warning that these change user account state and may consume platform resources. In an agent setting, omission of consent and risk prompts can lead to unintended irreversible or costly actions on behalf of the user.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill states it will load local credentials from ~/.bilibili-cli/credential.json and automatically extract browser cookies from multiple browsers, but provides no privacy warning, scope limitation, or consent requirement. In an agent environment, this creates a serious risk of unauthorized credential access and silent use of sensitive session material.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.