bilibili-source
Fail
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: HIGHCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on shell scripts (scripts/bili-fetch.sh, scripts/bili-danmaku.sh, scripts/bili-subs.sh) that execute system utilities such as curl, jq, python3, and yt-dlp to perform its tasks.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content, such as video titles, partition names, tags, and danmaku (bullet-comments) from Bilibili. This data is ingested into the agent context without sanitization.
- Ingestion points: scripts/bili-fetch.sh (video metadata), scripts/bili-danmaku.sh (danmaku text)
- Boundary markers: Absent
- Capability inventory: Network requests (curl), shell execution (yt-dlp, python3, jq)
- Sanitization: Absent
- [REMOTE_CODE_EXECUTION]: Analysis of the automated scan finding in scripts/bili-danmaku.sh confirms it is a false positive. The script pipes data from an API call into a static Python one-liner to handle decompression, rather than executing the downloaded content as code.
- [EXTERNAL_DOWNLOADS]: The skill fetches data from api.bilibili.com, b23.tv, and Bilibili CDNs. These are standard operations for the skill documented purpose.
- [CREDENTIALS_UNSAFE]: Subtitle fetching in scripts/bili-subs.sh accesses browser cookies via yt-dlp. The skill documentation explicitly instructs the agent to obtain user consent before performing this operation to mitigate the risk of unauthorized access.
Recommendations
- HIGH: Downloads and executes remote code from: https://api.bilibili.com/x/v1/dm/list.so?oid=$cid - DO NOT USE without thorough review
Audit Metadata