T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/transcribe.py:107- Finding
Arbitrary outbound requests through weak short-link validation
- Content
View full analysis
- Remediation
View remediation
Security audit
Bilibili Video Parser
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does what it says, but its URL handling can make the agent contact non-Bilibili or internal network addresses despite claiming a narrower network boundary.
Install only if you are comfortable with a local tool that makes outbound network requests and downloads Python dependencies/models. Use trusted Bilibili links, prefer full bilibili.com/video/BV... URLs over short links, run it in a constrained environment if possible, and consider pinning faster-whisper before use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/transcribe.py:185- Finding
Unvalidated API-provided subtitle and audio URLs permit unintended network access
- Content
View full analysis
None: """Download the audio file to the specified path.""" print(f"[1/3] Download audio -> {dest}") headers = { "User-Agent": PC_UA, "Referer": "https://www.bilibili.com", } if not _http_download(url, dest, headers, max_timeout=300): sys.exit("[ERROR] Audio download failed") ``` ### Technical Analysis The subtitle and audio URLs originate from a remote API response and are treated as trusted destinations. Before requesting them, the code does not validate: - The URL scheme. - The destination hostname. - The resolved IP address. - Redirect targets. - The response content type. - The maximum subtitle or audio response size. Although the expected values are Bilibili CDN URLs, the implementation does not enforce that expectation. If an upstream response is compromised, manipulated, or changes format, the process can be directed to an arbitrary public or internal endpoint. For audio, the downloaded response is subsequently parsed by the media stack used by `faster-whisper`, including PyAV. This expands the risk from unintended network access to processing attacker-controlled malformed media. The requests inc ...[truncated 1676 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:58- Finding
Unpinned third-party dependency installation creates supply-chain risk
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: ``` The exact version and hash should be selected after reviewing the target platform's official artifact rather than copied from an untrusted source. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill requests or instructs use of powerful capabilities (environment access, file read/write, network, and shell/Python execution) but does not declare an explicit machine-readable tool scope such as permissions or allowed-tools. This creates a policy gap: an agent or reviewer cannot reliably enforce least privilege, increasing the chance the skill is executed with broader access than intended.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def fetch_video_info(bvid: str) -> dict: """从B站公开 API 获取视频元数据""" api_url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}" raw = _http_get(api_url, BILI_HEADERS, max_timeout=20) data = json.loads(raw)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def fetch_video_info(bvid: str) -> dict: """从B站公开 API 获取视频元数据""" api_url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}" raw = _http_get(api_url, BILI_HEADERS, max_timeout=20) data = json.loads(raw)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def fetch_video_info(bvid: str) -> dict: """从B站公开 API 获取视频元数据""" api_url = f"https://api.bilibili.com/x/web-interface/view?bvid={bvid}" raw = _http_get(api_url, BILI_HEADERS, max_timeout=20) data = json.loads(raw)
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code sets the output document language to
zh-CN, which enforces a specific locale in the generated report. The file also defaults the transcription language to Chinese elsewhere, and there is no user-facing opt-in or explanation that the HTML report is intended to be Chinese-only.- Content