Agent Economy ReportAgent Economy ReportCAUTION version 1.0.24 · audited 2026-09-17
This package is a Bilibili toolkit that can monitor hot and trending videos, download videos and subtitles, look up stats and danmaku, and upload, schedule, or edit videos. Most features use public Bilibili APIs, but publishing and high-quality downloads accept full Bilibili session cookies, which are sent to Bilibili-owned domains and are not intentionally exfiltrated. It writes downloaded media and subtitles to local disk, can optionally persist credentials to a 0600 .credentials.json file, and runs ffmpeg without a shell to merge video and audio streams. Publisher functions that modify the account default to dry-run and require both dry_run=False and confirm=True before making changes. No clear exfiltration or wallet redirection was found, but the credential scope, optional persistence, a possible third-party model download in the faster-whisper fallback, and a few filename-sanitization gaps require review, so the verdict is CAUTION.
| Declared purpose | A comprehensive Bilibili toolkit for hot monitoring, video downloading, data tracking, subtitle extraction, video playback, and video publishing. |
| Observed behavior | The code implements modules that call Bilibili APIs over HTTPS for hot lists, video info, stats, subtitles, danmaku, playback URLs, downloads, and publishing. It reads local files for upload or conversion and writes downloaded or converted media and subtitle files. Authentication uses full Bilibili session cookies through shared httpx clients. Publisher mutations are gated behind dry_run/confirm, and one shell-free ffmpeg subprocess merges local video/audio streams. A separate developer bash script rewrites skill.json and runs clawhub publish, but it is not part of the runtime entry point. |
| Verdict, rules only | CAUTION · runs subprocesses or eval/exec |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | Makes HTTPS calls to api.bilibili.com, member.bilibili.com, www.bilibili.com, and upos-sz-upcdnbda2.bilivideo.com for metadata, downloads, stats, subtitles, danmaku, playback, and publishing. |
| shell | needed | Runs ffmpeg via asyncio.create_subprocess_exec without a shell for muxing local streams. The package also includes a bash release helper that runs clawhub publish, which is not needed for core Bilibili operations. |
| filesystem_read | needed | Reads local video, cover, credential, and subtitle files for uploading, conversion, merging, and optional persisted authentication. |
| filesystem_write | needed | Writes downloaded videos and subtitles, converted or merged subtitle files, and optionally .credentials.json when persistence is enabled. |
| credentials | needed | Accepts full Bilibili session cookies: SESSDATA, bili_jct, and buvid3. These are required for publishing and high-quality downloads and are attached to authenticated HTTP clients. |
| persistence | exceeds purpose | Optional .credentials.json persistence only when BILIBILI_PERSIST, persist=True, or save_to_file() is used. It is disabled by default. |
| install_packages | needed | requirements.txt pins httpx, aiohttp, beautifulsoup4, lxml, and requests; installation uses pip install -r requirements.txt. |
| severity | finding |
|---|---|
| info | Core modules use the official Bilibili API base The hot monitor, downloader, watcher, player, and subtitle modules call endpoints rooted at api.bilibili.com. This matches the declared Bilibili toolkit purpose. src/utils.py:13 API_BASE = "https://api.bilibili.com" |
| info | Video uploads target a Bilibili upload CDN The publisher builds the upload endpoint from a hardcoded Bilibili CDN hostname and the upos_key returned by Bilibili. This is consistent with video publishing. src/publisher.py:585 upload_base = f"https://upos-sz-upcdnbda2.bilivideo.com/{upos_key}" |
| medium | Authenticated HTTP client attaches full session cookies Whenever auth.get_client() is used, the full SESSDATA, bili_jct, and buvid3 cookies are attached. This is needed for publishing and some high-quality access, but the same client is also used for otherwise public Bilibili API calls when credentials are present. src/auth.py:204 cookies=self.cookies, |
| low | Optional credential persistence uses 0600 permissions Credentials are written only when persistence is enabled or save_to_file is called. The file is opened with mode 0600, and the code refuses group- or world-writable directories. src/auth.py:283 fd = os.open(filepath, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600) |
| info | ffmpeg subprocess is shell-free and hardened This invokes a locally resolved ffmpeg binary without a shell to mux downloaded video and audio streams. The code uses sanitized local paths, a minimal environment, and a timeout. src/downloader.py:453 proc = await asyncio.create_subprocess_exec( |
| medium | Download filename uses unsanitized format string The format parameter is interpolated into the output filename without sanitization. If a caller or agent supplies a value containing path separators or .., the resulting filepath can escape the selected output directory. The schema lists allowed values, but the code does not enforce them. src/downloader.py:239 filename = f"{title}.{format}" |
| medium | Subtitle filename uses unsanitized language and format The language and format parameters are placed in the output filename without sanitization. Path separators or .. in either value can escape the output directory. src/subtitle.py:168 filename = f"{title}_{language}.{format}" |
| medium | Optional faster-whisper fallback may download a model from outside declared domains When closed captions are absent, the fallback imports faster-whisper and instantiates WhisperModel('base'). This can trigger a third-party model download when no local cache exists, but the package's declared allowed domains and endpoint documentation do not list that model host. src/subtitle.py:418 model = WhisperModel("base", device="cpu", compute_type="int8") |
| low | Developer release script runs clawhub publish The script rewrites the version field in skill.json and executes the clawhub CLI to publish the project. It is not invoked by the runtime entry point, but it is present as shell tooling and is outside the Bilibili operations described for the skill. scripts/publish.sh:104 clawhub publish "${PROJECT_ROOT}" --version "${NEW_VERSION}" |
| medium | Self-reported warning about cookie exposure The package's own skill card says server security evidence warns that cookies may be attached to broader network requests than the documentation promises. This conflicts with README and skill.md claims that requests are sent only to Bilibili endpoints and should be reviewed before providing cookies. skill-card.md:25 Risk: The skill can use full Bilibili session cookies, and server security evidence warns those cookies may be attached to broader network requests than the doc |
| info | Publisher mutation actions are gated by dry-run and confirm Upload, draft, schedule, and edit return a preview unless the caller explicitly passes dry_run=False and confirm=True. This guardrail is documented and consistent with the code. src/publisher.py:128 if dry_run or not confirm: |
| info | Activation guidance describes explicit user intent The documentation tells agents not to auto-activate on links or BV numbers and to require explicit user intent. This is normal skill guidance and does not attempt to override other rules. skill.md:69 本 Skill 不会仅因消息中出现 Bilibili 链接或 BV 号就自动激活 |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| api.bilibili.com | not in the service index | src/utils.py:13 |
| clawhub.ai | not in the service index | skill-card.md:9 |
| github.com | not in the service index | README.md:43 |
| img.shields.io | not in the service index | README.md:8 |
| member.bilibili.com | not in the service index | src/publisher.py:18 |
| upos-sz-upcdnbda2.bilivideo.com | not in the service index | src/publisher.py:585 |
| www.bilibili.com | not in the service index | README.md:123 |
| Binaries invoked | base64, bash, chmod, git, pip, python, python3 |
| Environment variables read | BASH_SOURCE, BILIBILI_BILI_JCT, BILIBILI_BUVID3, BILIBILI_PERSIST, BILIBILI_SESSDATA, BUMP, CURRENT_VERSION, MAJOR, MINOR, NEW_VERSION, PATCH, PATH, PROJECT_ROOT, SCRIPT_DIR, SEMVER_RE, SKILL_JSON |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 14 |
| base64 blobs | 0 |
| File writes | 11 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
README.md | 507 | be2dc06a09668cd4… |
STRUCTURE.md | 16 | 746788f6f129ee1d… |
_meta.json | 6 | 0ffcac89c8ab2de4… |
main.py | 158 | 687bd370db791ee5… |
requirements.txt | 5 | 0708a4e28dcc7616… |
scripts/publish.sh | 106 | c739b8d18655a74e… |
skill-card.md | 59 | e9f1d50f5f1dface… |
skill.json | 418 | bef4b0f61b5a740a… |
skill.md | 606 | 92602328d62540c6… |
src/__init__.py | 19 | da3198962dce2834… |
src/auth.py | 310 | 04b3cb0cdf681f54… |
src/downloader.py | 527 | 254a69d15c9f0800… |
src/hot_monitor.py | 241 | 3b7fc7dc4af3cb8d… |
src/player.py | 390 | fb18175aede2ddb1… |
src/publisher.py | 786 | 3fd2548bb127376e… |
src/subtitle.py | 730 | 73dfb3ea42d011fb… |
src/utils.py | 275 | d4ac2f350651e4f3… |
src/watcher.py | 310 | 742a5d1e80d6e4c4… |
For agents
JSON: https://agenteconomy.report/k/bilibili-all-in-one.audit.json · badge: https://agenteconomy.report/k/bilibili-all-in-one.audited.svg ·
skill rating: /k/bilibili-all-in-one · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).