bilibili-subtitle

Warn

Audited by Socket on Aug 6, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/cookie_login.py

This module is a QR-based Bilibili login automation tool that extracts highly sensitive authentication cookies (SESSDATA and bili_jct) from a legitimate remote login flow and writes them in plaintext to a user-specified file path. No overt malware indicators (obfuscation, eval/exec, credential exfiltration to arbitrary domains, or system control) are present in the snippet; however, the behavior is security-sensitive and materially increases risk if the output file path is exposed or tampered with, or if the package is run in an untrusted/sandbox-less context. Use only from trusted sources and protect the generated cookie file with restrictive permissions.

Confidence: 66%Severity: 58%
Audit Metadata
Analyzed At
Aug 6, 2026, 03:06 AM
Package URL
pkg:socket/skills-sh/BAIKEMARK%2Fbilibili-summary-skill%2Fbilibili-subtitle%2F@01dac3e8c69c29951970c7ebb50028f7210f7d08
Security Audit — socket — bilibili-subtitle