Security audit

Bili Checkin

Security checks across malware telemetry and agentic risk

Overview

This skill matches its Bilibili automation purpose, but it handles powerful session cookies in a risky way and can mutate a user's account.

Install only if you trust the skill and the local machine. Treat SESSDATA and bili_jct like passwords: do not paste them into shared chats, delete .cookies.json when done, revoke or refresh the Bilibili session if exposed, and confirm exactly which account actions will run before using daily tasks or danmaku check-ins.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes local Python scripts that read and write cookies, perform network requests to Bilibili, and execute via shell, yet it declares no permissions. This creates a dangerous transparency gap: users and the hosting platform are not clearly informed that the skill can store credentials locally and automate account actions over the network.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The setup instructions tell users to extract and pass session cookies (SESSDATA and bili_jct) on the command line without clearly warning that these are sensitive authentication secrets. Command-line arguments can be exposed through shell history, process listings, logs, screenshots, or copied transcripts, which could allow account takeover or unauthorized use of the user's Bilibili account.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger list includes broad everyday terms such as '升级', '刷经验', and '亲密度', which can cause the skill to activate during unrelated conversations. Because this skill performs account actions and can save or use sensitive cookies, accidental invocation is more dangerous than for a read-only informational skill.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: Using fuzzy 'contains' matching without boundary rules makes activation ambiguous and easy to trigger unintentionally. In this context, accidental activation can lead to automated posting, sharing, coin spending, or use of previously saved session cookies against a user's account.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs users to save Bilibili session cookies such as SESSDATA and bili_jct, which are sensitive authentication credentials, but does not provide prominent warnings about account takeover risk, local storage exposure, or misuse by other processes. Since the saved cookies are then shared across scripts for automated actions, compromise of those values could allow unauthorized actions on the user's account.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill explicitly instructs users to extract and paste Bilibili session cookies (SESSDATA and bili_jct) into chat, which are authentication secrets that can enable account actions if intercepted, logged, or mishandled. The later note not to print cookies back to chat does not mitigate the core issue: the design normalizes collection of reusable credentials through conversational channels.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script persists live authentication material (SESSDATA and bili_jct) to a local file, enabling replay of the user's authenticated Bilibili session if that file is read by another local user, malware, backup process, or accidentally committed. Although chmod 0600 helps, it does not eliminate risk and the workflow explicitly asks users to extract high-value cookies from browser storage and save them outside the browser's protections.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script loads persistent authentication cookies from a local file and then performs state-changing actions on the user's Bilibili account, including share, coin, heartbeat/watch simulation, and live sign-in. While this appears to be intended automation rather than credential theft, it is risky because it can trigger account actions without strong user confirmation, and anyone with access to the cookie file can reuse those credentials to act as the user.

Ssd 3

High

Confidence: 99% confidence
Finding: The instructions directly ask the user to disclose live authentication cookie values in natural language, which is unsafe because chat systems may retain logs, telemetry, or transcripts accessible beyond the immediate session. In this skill's context, those cookies are then used to perform account actions like daily tasks and live-room posting, so disclosure could enable unauthorized use of the user's Bilibili account.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.