Bilibili Video Parser

• Outcome: Review
• Latest audit: Jul 31, 2026 · 2:37 AM UTC
• Version: 0.1.0

Overview

The skill is purpose-aligned for analyzing Bilibili videos, but its helper script can execute shell commands built from user paths and network-provided URLs, and it sends media-derived content to an external AI CLI without a clear privacy warning.

Review before installing. Use this only on videos you are allowed to process, assume frames/audio may be sent through the configured z-ai provider, and avoid untrusted work-dir paths or relying on untrusted media/subtitle URLs until the script replaces shell=True command strings with safe argument-list subprocess calls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_cmd(cmd, timeout=60):
    """Run a shell command and return stdout."""
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    if result.returncode != 0:
        print(f"[WARN] Command failed: {cmd}", file=sys.stderr)
        print(f"  stderr: {result.stderr[:200]}", file=sys.stderr)

• Confidence: 98% confidence
• Finding: result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly instructs users to send extracted video frames and audio chunks to an external AI CLI/provider for visual analysis and speech transcription, but it does not clearly warn that potentially sensitive media content will leave the local environment and be processed by a third party. This creates a real privacy and data-governance risk, especially if users analyze private, copyrighted, or sensitive videos without understanding the disclosure implications.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger description includes very broad verbs like 'watch', 'analyze', 'read', 'understand', and 'extract', which can cause the skill to activate in many ordinary conversations that merely mention a Bilibili link. Because this skill downloads media, extracts frames, and transcribes audio, over-triggering can lead to unintended collection and processing of third-party content or user-shared material without clear necessity.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill performs downloading, frame extraction, visual analysis, and speech transcription, but it does not require a user-facing warning or consent flow about sending media-derived data to external tools and services. This creates a privacy risk because spoken content, on-screen text, and imagery may contain personal or sensitive information that is processed beyond the user's likely expectations.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The instruction hard-codes Chinese output for visual analysis without checking the user's language preference. While not a direct security exploit, forced language behavior can override user intent, reduce transparency, and make review of extracted content harder for users who do not read Chinese, especially when the skill is summarizing externally sourced material.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Video frames are sent to an external vision tool for analysis, but the script does not explicitly disclose that extracted content may leave the local environment. If users process sensitive or private videos, this can cause unintended data exposure to third-party services or local tools configured to call remote APIs.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Audio chunks are passed to an external ASR tool without warning the user that speech content may be transmitted or retained outside the host. This can expose private conversations, copyrighted material, or regulated data if the ASR backend is remote.

Unvalidated Output Injection

High

• Category: Output Handling

Content

def run_cmd(cmd, timeout=60):
    """Run a shell command and return stdout."""
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    if result.returncode != 0:
        print(f"[WARN] Command failed: {cmd}", file=sys.stderr)
        print(f"  stderr: {result.stderr[:200]}", file=sys.stderr)

• Confidence: 99% confidence
• Finding: subprocess.run(cmd, shell=True, capture_output

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def run_cmd(cmd, timeout=60):
    """Run a shell command and return stdout."""
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    if result.returncode != 0:
        print(f"[WARN] Command failed: {cmd}", file=sys.stderr)
        print(f"  stderr: {result.stderr[:200]}", file=sys.stderr)

• Confidence: 98% confidence
• Finding: subprocess.run(cmd, shell=True

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.