T09 · Insecure Skill Coding Practices
Warning
- Location
references/cookie-setup.md:19- Finding
Authentication Session Cookie Stored Without Enforced Access Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Bilibili Video Summarizer
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-aligned for Bilibili subtitle summarization, but it asks users to paste and persist a login session cookie with weak warnings and unsafe install guidance.
Review before installing. Use this only in a trusted local environment, treat SESSDATA as a login credential, prefer manually creating the cookie file with restrictive permissions, delete or revoke the cookie after use, and avoid the recommended system-level pip install in favor of an isolated pinned installation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:82- Finding
Unpinned Dependency Installation Bypasses System Python Protections
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill description emphasizes subtitle download and summarization but omits that it requires a persistent authenticated Bilibili cookie stored locally. Undeclared handling of authentication material is security-relevant because users may provide a session token without understanding that it grants account access and will be stored on disk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill description emphasizes subtitle download and summarization but omits that it requires a persistent authenticated Bilibili cookie stored locally. Undeclared handling of authentication material is security-relevant because users may provide a session token without understanding that it grants account access and will be stored on disk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the user to extract the Bilibili SESSDATA cookie from the browser console and paste it into the system, then save it persistently to disk, without a clear warning that this is effectively an account session credential. Session cookies can enable account takeover or unauthorized use if exposed, and normalizing this collection pattern also trains users into unsafe credential-handling behavior.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 77% confidence
- Finding
The skill describes reading and writing local files, including a cookie file under the user's home directory, but does not declare any tool scope or permissions. That creates an authorization gap where the agent may access sensitive local data without explicit least-privilege boundaries, increasing the chance of overbroad file access during execution.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad natural-language requests like '这个视频说了什么' and '视频内容是什么', which can match ordinary conversation and cause the skill to activate unexpectedly. In this skill, accidental activation is more concerning because it can lead to prompts for sensitive login cookies and local file operations unrelated to the user's intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guide tells users to paste their SESSDATA cookie directly to the agent and even automates saving it, but does not prominently warn that this cookie is an authentication credential tied to the user's logged-in session. In the context of an agent skill, this is more dangerous because users may assume conversational input is low risk, while providing the token grants the tool account-authenticated access and increases exposure through chat history, logs, or unintended reuse.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The privacy note is misleading because the cookie must be transmitted to bilibili in authenticated requests for the tool to function, so claiming it is 'never sent elsewhere' is materially inaccurate. This can cause users to underestimate how their authentication token is used and mishandle a credential that enables account-authenticated access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script automatically loads a persistent Bilibili cookie file and transmits it to yt-dlp for any user-supplied URL, but only mentions the cookie after execution begins and does not provide a clear user-facing consent or scope warning. In an agent skill context, this is sensitive because the skill may cause account-authenticated requests using the operator's session token, potentially exposing private account access patterns or enabling misuse if an attacker can influence the URL or trigger behavior unexpectedly.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The script creates an output directory and later writes subtitle files into it. Although an optional output_dir argument exists, there is no explicit warning or disclosure in the script output that it will create directories and save files on disk.
- Content