bilibili-subtitles
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of a Python script (
scripts/download.py) to manage network communication with Bilibili and handle local file operations. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could potentially be used to target downstream agents that consume the generated subtitle files.
- Ingestion points: Video metadata (titles) and subtitle content are fetched from
api.bilibili.cominscripts/download.py. - Boundary markers: Output files (SRT, CSV) are stored in the
projects/directory without specific instructional delimiters. - Capability inventory: The script performs network requests, file writes, and ZIP archive generation.
- Sanitization: The
safe_file_componentfunction is used to sanitize filenames by removing illegal characters and restricting length, effectively preventing basic path traversal attempts.
Audit Metadata