The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation in references/runtime-requirements.md and references/troubleshooting.md explicitly recommends using third-party proxy services (gh-proxy.com and gh-proxy.org) to download the biliup executable binary. Automated scanners have flagged gh-proxy.com as a phishing domain and identified the markdown files containing these links as having malicious reputations.
[REMOTE_CODE_EXECUTION]: The skill is designed to automatically download, update, and execute the biliup binary from GitHub Releases at runtime using the sau CLI. This auto-provisioning of executables from remote sources, especially when routed through untrusted third-party proxies, creates a significant remote code execution risk.
[COMMAND_EXECUTION]: The skill utilizes shell command execution via the sau CLI and Python's subprocess module. The file scripts/examples/bilibili_cli_template.py demonstrates the execution of commands using subprocess.run(), which interfaces with the system's command interpreter.
[DYNAMIC_EXECUTION]: The skill relies on runtime retrieval of executable content. It bypasses standard package managers to fetch binaries directly from the web, which are then executed by the local environment to perform Bilibili operations.

bilibili-upload