Skills/Glama/bili-open-mcp

bili-open-mcp@2.1.0

VERIFIED· startup only

Publisher claims: "Lets AI agents search 170 Bilibili open-platform docs and 100 endpoints, then build 2.0 HMAC-SHA256 signatures, run OAuth2 flows, plan video uploads, verify webhooks, and call live-room WebSocket protocols. Also handles cookie-based web requests with automatic csrf and wbi signing, plus code generation, error-code lookup, and sandbox mocks." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher 3810220770 · publishing for 3 daysInstalls 0Last detonated 3d ago
$npx skills add bili-open-mcp
WatchReport an issue

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
BILI_ACCESS_KEY_IDBILI_ACCESS_TOKENBILI_APP_SECRETBILI_SECRETBILI_TOKENConfiguration, not credentials: BILI_CLIENT_ID, BILI_COOKIE_FILE, BILI_CRED_FILE, BILI_DEBUG_DOC, OPENCODE_CONFIG
Where it talks to
no vendor host named in the codeAlso bilibili.com, bilivideo.com, opencode.ai, sitemaps.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names bilibili.com, bilivideo.com, opencode.ai, sitemaps.org as well as its own vendor. The guard injects BILI_ACCESS_KEY_ID, BILI_ACCESS_TOKEN, BILI_APP_SECRET, BILI_SECRET, BILI_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 26 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
5.9sprocessdependency install exit 0
26sclaimedstartup only: exited (0) before answering · syscall: 'open', path: '/tmp/ks-detonate-iVbNkL/task/home/work/acme-api/.claude/skills/bili-open-mcp/data/status-codes.json' } Node.js v22.23.4
26sprocessscript backend runs setup only
26sprocessno install scripts to re-run

Static findings

HIGH
URL with embedded credentialsdata/index.json:8335 · URL with embedded credentials — may be phishing or credential leaking…' \\\n--header 'Connection: keep-alive' \\\n--data-raw '{\n \"items_url\": \"https://detail.tmall.com/item.htm?id=871808936421&ali_trackid=2:mm_3546734339_2765250049_114653600169:1737019883553_560407525_1&fromUld=1&spm=a2e0b.27956566.d1673…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
URL with embedded credentialsdata/index.json:8336 · URL with embedded credentials — may be phishing or credential leaking… \"items_name\": \"【大人推荐】太丰年货礼盒牛肉干牛肉条芝香脆脆猪肉脯食全食美\",\n \"items_url\": \"https://detail.tmall.com/item.htm?id=871808936421&ali_trackid=2:mm_3546734339_2765250049_114653600169:1737019883553_560407525_1&fromUld=1&spm=a2e0b.27956566.d1673245246…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
File type combined with upload actionscripts/build-site.mjs:818 · File type combined with upload action — agent may exfiltrate local data files["真调开放平台接口、投稿、上传", "secrets/open-platform.json", "bili_api_call · bili_upload_plan · bili_oauth"],Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
URL with suspicious TLDdata/index.json:8335 · URL with suspicious TLD — commonly used for phishing/malware… \"url_list\": [\n {\n \"type\": 1,\n \"url\": \"https://s.click.taobao.com/9YfF90t\"\n }\n ],\n \"channel_code\": \"10001\",\n …Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with suspicious TLDdata/index.json:8336 · URL with suspicious TLD — commonly used for phishing/malware…QAI\",\n \"url_list\": [\n {\n \"jump_url\": \"https://s.click.taobao.com/t?e=m%3D2%26s%3DqEIk5Qtqp5Fw4vFB6t2Z2ueEDrYVVa64yK8Cckff7TVRAdhuF14F…Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/build-site.mjs:1409 · npx invocation of non-well-known package — may execute untrusted codeconsole.log("本地预览 : npx --yes serve docs 然后打开 http://localhost:3000");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)SKILL.md:5 · MCP server using network transport (SSE/HTTP) — data sent over networkMCP server 3810220770/bili-open-mcp-bilibili-mcp-server on Glama, built from https://github.com/3810220770/bili-open-mcp-bilibili-mcp-server.Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04

Cost to the agent

Instructions loaded
≈8,986 tok
2 files · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

bili-open-mcp@2.1.0 safety verdict: Verified (startup only) — KillerSkills