bilibili-all-in-one

• Outcome: Pass
• Latest audit: Aug 14, 2026 · 8:30 AM UTC
• Version: 1.0.0

Overview

This is a disclosed Bilibili toolkit with sensitive but purpose-aligned account and file capabilities, with some credential-storage and dependency hygiene cautions to review before use.

Install only if you are comfortable giving the skill Bilibili session cookies for publishing or high-quality downloads. Prefer a test account, leave BILIBILI_PERSIST unset unless you need disk persistence, delete .credentials.json when done, and consider updating the pinned dependencies in an isolated virtual environment before serious use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises no declared permissions, yet static analysis detected capabilities for environment access, file read/write, networking, and shell execution. This creates a transparency and least-privilege problem: users and reviewers cannot accurately assess the operational risk, and the combination of shell plus network plus filesystem access is powerful enough to enable command execution, data exfiltration, or unauthorized local changes if abused or compromised.

Intent-Code Divergence

Low

• Confidence: 91% confidence
• Finding: The README gives inconsistent statements about credential persistence: one section says credentials are not persisted by default unless `save_to_file()` is called, while another explicitly documents automatic persistence via `persist=True` or `BILIBILI_PERSIST=1` to `.credentials.json`. For a skill handling live Bilibili session cookies, contradictory storage behavior can cause operators to unknowingly leave reusable auth tokens on disk, increasing risk of credential theft on shared or compromised systems.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill exposes optional persistence of Bilibili authentication cookies to a local JSON file, which creates a real credential-handling risk. Session cookies such as SESSDATA and CSRF tokens can grant account access, and storing them on disk without visible safeguards, warnings, or secure storage requirements increases the chance of accidental disclosure through weak filesystem permissions, backups, or source-control mistakes.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The skill explicitly includes video uploading and publishing, which are remote account-affecting actions, but the interface and help text do not present any safety prompt, confirmation, or warning. In an agent setting, this increases the risk of unintended publication or abuse if the capability is invoked with valid credentials, especially because publishing changes external state on the user's account.

Missing User Warnings

Medium

• Confidence: 73% confidence
• Finding: When no subtitles are available, the module automatically attempts fallback strategies that download audio, process media locally, and write output files without an explicit confirmation boundary at the point of fallback. In agent environments, this can violate user expectations, create unanticipated local artifacts, and process larger or more sensitive media than the user intended when they only requested subtitles.

Credential Access

High

• Category: Privilege Escalation

Content

credential_file: Path to JSON credential file.
            persist: Whether to persist credentials to disk (default: False).
                Set to True or env BILIBILI_PERSIST=1 to auto-save/load
                credentials from .credentials.json.
        """
        self.auth = BilibiliAuth(
            sessdata=sessdata,

• Confidence: 91% confidence
• Finding: The code supports automatic save/load of authentication material from a local .credentials.json file, which is credential access/storage behavior involving highly sensitive session cookies. In this skill context, those cookies can be reused to download gated content or publish videos on behalf of the user, so compromise of the file could directly enable account takeover-like misuse.

Credential Access

High

• Category: Privilege Escalation

Content

# Default path for persisted credentials (relative to project root)
DEFAULT_CREDENTIAL_FILE = os.path.join(
    os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
    ".credentials.json",
)

# Maximum age (in seconds) of a persisted credential file before it is

• Confidence: 85% confidence
• Finding: The module persists authentication cookies to a predictable on-disk file in the project tree. Even though the implementation adds meaningful safeguards like 0600 permissions, stale-file checks, and writable-directory checks, storing reusable session credentials on disk still increases theft and session-hijack risk if the host, repo workspace, backups, or developer environment are compromised.

Known Vulnerable Dependency: aiohttp==3.10.11 — 10 advisory(ies): CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi); CVE-2026-34517 (AIOHTTP has late size enforcement for non-file multipart fields causes memory Do) +7 more

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The dependency is pinned to aiohttp 3.10.11, which static analysis reports as having multiple known advisories, including cookie-scope handling issues, CRLF/header injection, and multipart parsing weaknesses. In a network-facing skill that fetches remote content from Bilibili and potentially other URLs, vulnerable HTTP client behavior can increase risk of credential leakage, request smuggling/header injection, or denial of service if attacker-controlled responses or inputs are processed.

Known Vulnerable Dependency: lxml==5.3.0 — 2 advisory(ies): CVE-2026-41066 (lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to); CVE-2026-41066 (lxml is a library for processing XML and HTML in the Python language. Prior to 6)

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The skill includes lxml 5.3.0, which is flagged for XXE-related issues in XML parsing defaults. Because this skill also includes HTML/XML parsing libraries and interacts with remote content over HTTPS, unsafe parser defaults could allow malicious documents to trigger external entity resolution, local file disclosure, SSRF, or parser abuse if XML inputs are ever processed.

Known Vulnerable Dependency: requests==2.32.3 — 4 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs) +1 more

Medium

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: Requests 2.32.3 is reported with known advisories including .netrc credential leakage via malicious URLs and insecure temporary file handling in utility code. This matters more in a skill that performs remote HTTP requests and may handle authenticated sessions/cookies for Bilibili publishing, because malformed or attacker-influenced URLs could expose credentials or sensitive local data paths under certain usage patterns.

Static analysis

No suspicious patterns detected.