T08 · Insecure Dependencies
Error
- Location
scripts/install_check.py:9- Finding
Runtime Installation Uses an Ambiguous Distribution Name
- Content
View full analysis
- Remediation
View remediation
Security audit
Analysis of comments on Bilibili videos
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but its dependency installers are under-disclosed and can install unpinned or ambiguous third-party packages into the user's Python environment.
Review before installing. Use an isolated virtual environment, avoid running the included install_check.py or install_deps.sh as-is, install only reviewed pinned dependencies, and treat generated Markdown as containing untrusted public Bilibili user content.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/install_deps.sh:5- Finding
Unpinned and Unnecessary Third-Party Packages Are Installed
- Content
View full analysis
=2.28.0 jieba>=0.42.1 snownlp>=0.15.2 ``` ```text bilibili-api-python>=10.2.1 jieba>=0.42.1 snownlp>=0.15.2 wordcloud>=1.9.3 matplotlib>=3.8.0 pandas>=2.1.0 ``` ### Technical Analysis The shell installer requests the latest package versions available at installation time. The requirement files similarly use `>=` constraints without upper bounds or cryptographic hashes. Consequently, two installations performed at different times can resolve different code and transitive dependency trees. The core analyzer imports `requests`, `jieba`, and `SnowNLP`. It does not import `bilibili-api-python`, `pandas`, `matplotlib`, or `wordcloud`, yet the installation files add these packages to the environment. Installing unused packages unnecessarily increases the number of publishers, release artifacts, installation hooks, and transitive dependencies that must be trusted. This is a supply-chain weakness rather than evidence that the listed packages are currently malicious. ### Attack Path 1. A user follows the installation instructions and runs `scripts/install_deps.sh` or installs from one of the requirement files. 2. Pip resolves the newest versions satisfying the open-ended constraints. 3. A malicious, compromised, or unexpectedly incompatible future release is selected, including through a transitive dependency. 4. Package installation code executes, or the altered package later executes when imported. 5. The payload runs with the permissions of the invokin ...[truncated 386 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze_video.py:317- Finding
Untrusted Bilibili Content Is Embedded into Markdown Without Adequate Escaping
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (32)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documentation describes capabilities that perform network access, write reports to disk, and invoke a Python script, but it does not declare any explicit tool scope or permission boundaries. This creates an authorization gap: an agent or platform may allow broader execution than users expect, increasing the risk of unintended network requests, local file creation, or shell/script execution without clear consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill is designed to collect comments, danmaku, usernames or user-associated content, and then analyze them, but the description does not warn users that third-party user-generated data will be gathered and processed. This is risky because users may unknowingly trigger collection of personal or behavioral data, creating privacy, compliance, and trust issues even if the source is public.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md def get_video_info(bvid: str) -> dict: url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}" resp = requests.get(url, headers=DEFAULT_HEADERS, timeout=10) data = resp.json() if data['code'] == 0:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md def get_video_info(bvid: str) -> dict: url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}" resp = requests.get(url, headers=DEFAULT_HEADERS, timeout=10) data = resp.json() if data['code'] == 0:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md def get_video_info(bvid: str) -> dict: url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}" resp = requests.get(url, headers=DEFAULT_HEADERS, timeout=10) data = resp.json() if data['code'] == 0:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md def get_video_info(bvid: str) -> dict: url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}" resp = requests.get(url, headers=DEFAULT_HEADERS, timeout=10) data = resp.json() if data['code'] == 0:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md def get_video_info(bvid: str) -> dict: url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}" resp = requests.get(url, headers=DEFAULT_HEADERS, timeout=10) data = resp.json() if data['code'] == 0:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md def get_video_info(bvid: str) -> dict: url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}" resp = requests.get(url, headers=DEFAULT_HEADERS, timeout=10) data = resp.json() if data['code'] == 0:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def get_video_info(bvid: str) -> dict: url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}" resp = requests.get(url, headers=DEFAULT_HEADERS, timeout=10) data = resp.json() if data['code'] == 0:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def get_video_info(bvid: str) -> dict: url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}" resp = requests.get(url, headers=DEFAULT_HEADERS, timeout=10) data = resp.json() if data['code'] == 0:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def get_video_info(bvid: str) -> dict: url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}" resp = requests.get(url, headers=DEFAULT_HEADERS, timeout=10) data = resp.json() if data['code'] == 0:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def get_video_info(bvid: str) -> dict: url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}" resp = requests.get(url, headers=DEFAULT_HEADERS, timeout=10) data = resp.json() if data['code'] == 0:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def get_video_info(bvid: str) -> dict: url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}" resp = requests.get(url, headers=DEFAULT_HEADERS, timeout=10) data = resp.json() if data['code'] == 0:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code fetches video metadata, danmaku, and comments from Bilibili over HTTP and then processes user-generated content, but it provides no explicit disclosure that remote requests will be made and third-party content will be collected. The progress prints only state that data is being fetched, not that public user comments/danmaku are being transmitted to or retrieved from external services for analysis.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generated report section is titled '视频简介', implying it will show the video's description. However, the code uses the first danmaku text instead of the actual video description whenever danmakus are present, which directly contradicts the label and misrepresents the data source.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest describes collecting B站 comments/danmu and generating a structured analysis report, but it does not mention persisting output to disk. The code accepts an output path and writes the full report to a local file, which is a behavior expansion beyond purely in-memory analysis/report generation.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python missing = [] for lib in required: try: __import__(lib) print(f"[OK] {lib}") except ImportError: missing.append(lib)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if missing: print("\n正在安装缺失的库...") for lib in missing: subprocess.check_call([sys.executable, '-m', 'pip', 'install', lib]) print("\n安装完成!") else: print("\n所有依赖已安装!")
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
The dependency specification uses a lower-bound only constraint for requests, which makes builds non-reproducible and can unintentionally pull in vulnerable or breaking future releases. In a skill that fetches remote B站 data over HTTP, the networking library is security-relevant, so lack of pinning modestly increases supply-chain and patch-management risk.
- Content
text # 无需登录版 - 使用B站公开API # 核心依赖 requests>=2.28.0 jieba>=0.42.1 snownlp>=0.15.2
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
The manifest includes requests without an exact version, while the package has multiple known advisories across some releases. Because the installed version is unverifiable from this file, there is a real risk that deployments may resolve to an affected version, especially across different build times or environments.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
The jieba dependency is not pinned to an exact version, so different environments may install different releases. This is primarily a reproducibility and supply-chain hygiene issue rather than an immediately exploitable flaw, but it can still introduce unreviewed code changes or vulnerable transitive behavior over time.
- Content
text # 核心依赖 requests>=2.28.0 jieba>=0.42.1 snownlp>=0.15.2 # 可选依赖 (用于词云等扩展功能)
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
The snownlp package is specified with a minimum version only, allowing future installations to resolve to different versions than originally tested. For an analysis skill processing untrusted text content, keeping NLP libraries deterministic reduces the chance of silently introducing insecure or unstable package updates.
- Content
text # 核心依赖 requests>=2.28.0 jieba>=0.42.1 snownlp>=0.15.2 # 可选依赖 (用于词云等扩展功能) # pandas>=2.0.0
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill description and user-facing CLI strings are written entirely in Chinese, which effectively forces a specific language without any opt-in or documented locale constraint. Under the stated policy, language restrictions should either be optional for the user or explicitly justified as region-specific.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The script writes the full generated report to an arbitrary output path when --output is provided, but there is no prior warning in the argument help, docstring, or prompt that a local file will be created or overwritten. The post-write print confirms completion, but it does not disclose the file-write behavior before it occurs.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring is written only in Chinese ("检查依赖是否安装"), and the script's user-facing messages are also exclusively Chinese, which imposes a specific language choice without offering an alternative. The policy calls for flagging language or locale constraints when they are forced without user opt-in or documented justification.
- Content
Static analysis
No suspicious patterns detected.