bilibili-page-reader
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using Node.js one-liners, Python scripts, FFmpeg, and file management utilities (
del) to process media and perform transcription. These operations are within the scope of the skill's stated purpose but involve dynamic command construction. - [PROMPT_INJECTION]: The skill ingests untrusted data from Bilibili, including user comments, danmaku, and transcribed audio content. This content is passed to the agent without filtering or sanitization, creating a potential surface for indirect prompt injection.
- Ingestion points: Browser evaluate calls (SKILL.md) fetching danmaku/comments and audio transcription results (audio2srt.py).
- Boundary markers: Data is structured using JSON and SRT formats, which provides structural delimitation but lacks security-hardened boundaries against malicious instructions.
- Capability inventory: The skill possesses shell execution capabilities (node, python, ffmpeg) and file system access.
- Sanitization: No validation or sanitization of the extracted user content is implemented before it is presented to the agent.
- [EXTERNAL_DOWNLOADS]: The skill downloads DASH audio streams from Bilibili's CDN and fetches ASR models from the ModelScope hub. These downloads target well-known services necessary for the skill's core functionality.
Audit Metadata