Docs & Knowledge · daymade/claude-code-skills

bilibili-source

Name: bilibili-source
Author: daymade/claude-code-skills

Fetch comprehensive, login-free data for any Bilibili (B站) video — title, UP name and follower count, publish date, partition, tags, per-part cids, live stats (view, like, coin, favorite, share, reply, danmaku), and full danmaku (bullet-comment) text. Use this skill whenever working with a Bilibili video and needing real, citable numbers or metadata — ingesting a Bilibili source into a knowledge base, analyzing why a video performed, verifying a creator's claimed metrics, building a case study, or any time a Bilibili view/like/favorite count is about to be written into a document — fetch it, never hand-type or estimate it. Accepts BVID, av numbers, b23.tv short links, or full URLs. Subtitles and favorites-folder (收藏夹) enumeration are also covered but require the user's Bilibili login.

L5 Restricted · Isolated sandbox & strict auditV2 Human-AuditedCredential / SessionExecute CommandNetwork AccessWrite FileDual-pass Audit

Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

The core design encapsulates 'a single view/detail API call + jq formatting' into a unified JSON: input is first normalized into bvid/aid query parameters, then fetched from api.bilibili.com and mapped into title/up/tags/stat/pages.

bilibili-source/scripts/bili-fetch.sh

json=$(bili_curl "https://api.bilibili.com/x/web-interface/view/detail?$q")

What happens here: The fetch script relies solely on curl+jq without requiring login; jq formats $d.View/$d.Card.card.fans/$d.Tags into {bvid, aid, fetched_at, up:{name,mid,fans}, stat:{view,like,...}, pages:[{cid,...}]}, outputting a complete pages[] array for multi-part videos (each part's cid serves as the key for subsequent danmaku/subtitles).

Network resilience encapsulation: Requests strip local proxy env vars (Bilibili is a mainland Chinese service, where local forward proxies break requests), include browser UA + Referer to avoid occasional HTTP 412 errors, and implement failure retry backoff.

bilibili-source/scripts/bili-fetch.sh

curl -fsSL --max-time 20 --retry 3 --retry-delay 1 --retry-all-errors -H "User-Agent: $UA" -H "Referer: https://www.bilibili.com"

bili_curl/np_curl is reused across four scripts (fetch/danmaku/selftest/subs) to ensure any invocation path uses the exact same env-stripping and headers; bili-selftest additionally asserts API shape invariants, surfacing drifts as FAIL lines rather than silent incorrect answers.

The danmaku script reuses fetch to resolve the part's cid, then requests dm/list.so, performs raw-DEFLATE decompression, and extracts text from each <d> element.

bilibili-source/scripts/bili-danmaku.sh

xml=$(bili_curl "https://api.bilibili.com/x/v1/dm/list.so?oid=$cid" | python3 -c "import sys,zlib; sys.stdout.buffer.write(zlib.decompress(sys.stdin.buffer.read(), -15))")

The comments explicitly note: 'list.so is headerless raw DEFLATE (zlib window bits -15), not gzip.' — a real-world format quirk encountered during testing; after decompression, grep -oE '<d [^>]*>[^<]*</d>' extracts each danmaku text line-by-line with a count printed to stderr.

Subtitle tracks enforce logged-in sessions: The script uses yt-dlp to read the user's browser cookies to pull subtitle tracks like ai-zh; the skill explicitly states 'There is no login-free path — do not try to bypass it' and requires asking the user beforehand.

bilibili-source/scripts/bili-subs.sh

yt-dlp --skip-download --write-subs --sub-langs "ai-zh,zh-Hans,zh-CN,zh" --user-agent "$UA" --add-header "Referer:https://www.bilibili.com" --cookies-from-browser "$browser"

Explicit discipline in SKILL.md: 'Subtitles require login (no bypass)…There is **no login-free path** — do not try to bypass it.' and 'Because it reads the user's logged-in session, **ask the user before running it**'; the ai-zh track is flagged as an AI-ASR draft rather than a human-verified transcript.

Data honesty discipline built into the workflow: Metrics must include a fetched_at timestamp, and missing data must be marked as 'Unretrieved/Unverified' rather than estimated, preventing knowledge bases from being contaminated by manual entries.

bilibili-source/SKILL.md

**Live metrics → always cite `fetched_at`.** … A bare "12,000 views" with no timestamp is meaningless and silently goes stale.

The fetch script output JSON inherently includes fetched_at (ISO timestamp via date -u), turning 'citations must be traceable' from a verbal guideline into an enforced data structure; this works alongside the NO FABRICATION rule ('If a number can't be fetched, write "未获取/未核实" — never estimate.').

Health checks against third-party API drift: bili-selftest.sh uses a fixed public fixture to assert each capability and login-gate invariant one by one, presenting drifts as PASS/FAIL lines.

bilibili-source/scripts/bili-selftest.sh

It asserts SHAPE (fields exist, right types) and documented INVARIANTS — never exact values, since engagement numbers drift by design.

Covers: av→BVID normalization, stat.view numeric values, up.fans path, pages completeness, full URL normalization, list.so decompression, anonymous subtitle lists must be empty (login-gate invariant), anonymous favorites enumeration must be empty. The documentation requires updating the 'Verified' date whenever an API drift occurs.

2Core Capabilities

01Fetch all metadata and real-time engagement statistics in a single call (title / UP info + follower count / partition / tags / multi-part cids / all stat fields)

02Full danmaku text without login (audience reaction timeline signals)

03Normalization of any pasted input format (BVID / av number / b23.tv short link / full URL)

04Authenticated subtitle/transcript track download (ai-zh/zh-Hans/zh-CN/zh; must prompt the user before execution)

05Authenticity and citability discipline: mandatory fetched_at timestamp + explicit 'Unretrieved/Unverified' fallback

06Live API self-testing (exposing drifts via PASS/FAIL lines, including login-gate invariant assertions)

07Deep endpoint directory: UP follower history, live viewer count, favorites-folder enumeration, WBI signing algorithm (references/bilibili_api.md)

3External Dependencies

Kind	Dependency / Endpoint
cli	curl
cli	jq
cli	python3
cli	yt-dlp
network	api.bilibili.com
network	b23.tv（短链展开，单跳 302）

4Recommended Governance & Evidence

Suggested Controls for Safe Operation

For Agent Runtime

Isolated environment, per-use explicit authorization

For Administrators

Strict authorization, full audit, compliance signoff

Evidence & Triggers (File Paths & Excerpts)

本地凭据 / 浏览器配置: Reads user login cookies/sessions/keyrings: bili-subs.sh via yt-dlp --cookies-from-browser "$browser" (chrome/firefox/safa
scripts/: Executes local scripts or commands: bilibili-source/scripts/bili-fetch.sh
网络端点: Declares external network access: https://api.bilibili.com/x/web-interface/view/detail (fetch)
本地工作目录: File I/O and artifact output: bili-subs.sh writes subtitle files to the current directory: <id>.<lang>.<ext> (json3/srt)

Audit Notes: Based on standard tiering: bili-subs.sh interacts with local browser login cookies via yt-dlp --cookies-from-browser (accessing cookies classifies as Orange; the skill itself explicitly marks ask-before-run); core fetch/danmaku/selftest scripts use standard public APIs without login (Yellow on their own), with selftest performing read-only probing against two api.bilibili.com endpoints. Outbound destinations target official Bilibili domains, which is expected. The Orange rating is primarily driven by the cookie access surface and third-party yt-dlp/update risks, followed by a minor SSRF surface when expanding b23.tv/full URL inputs (read-only HEAD/Location).

5Second-Pass Verification

[ok] fetch/danmaku 免登录（无凭证接触） — grep 复核三脚本无 Cookie/Authorization/SESSDATA 使用；bili_curl 只带 UA+Referer。
[ok] bili-subs.sh 读浏览器 cookie 且有 ask-first — --cookies-from-browser 实参存在；脚本头『Because it reads the user's logged-in session, ASK THE USER before running it.』存在。
[ok] 网络外发仅限 Bilibili 系域名 — 逐脚本重读：view/detail、dm/list.so、player/wbi/v2、fav/folder/created/list-all 均在 api.bilibili.com；短链 b23.tv；yt-dlp 目标为 bilibili.com 视频 URL。
[ok] raw-deflate 弹幕解压机制成立 — list.so 返回经 python3 zlib.decompress(..., -15)（window bits -15），与脚本注释『headerless raw DEFLATE』一致。
[ok] WBI 签名只在 reference（space/wbi/*）不在这批脚本里 — 脚本中 wbi 仅出现在 x/player/wbi/v2 端点名（登录门检测），无签名实现；reference 目录 TOC 标注 WBI 仅 space/wbi/* 需要。
[ok] 功能声明 vs 实际能力相符 — 『fetch real, verifiable data…never hand-type or estimate』由 fetched_at+NO FABRICATION+脚本落地；未发现夸大或无法定位的承诺。
[ok] 注入面（输入归一化） — BV 正则锚定 10 字符长度防过捕；aid 分支取纯数字；两者进入 query 而非 shell 求值。
[ok] 元数据（license/stars/commit） — 仓库级 MIT、stars=1385、pushed_at=2026-09-09T12:33:29Z；本地 HEAD==pin d5c4678cb5d4fd6acc9c922690df035dbd33d247。

6Verdict & Scenarios

Turns 'data honesty' into concrete structure and discipline: fetched_at is built into the output JSON, and unobtained metrics must be marked as 'Unretrieved/Unverified', fundamentally preventing knowledge base rot from manually typed figures.

Login-free primary path (metadata/stats/danmaku) + transparent login gates: features that can be fetched without login are exposed freely, while those that cannot are stated transparently without attempts to bypass.

Encapsulates numerous real-world lessons (proxy stripping, HTTP 412, raw-deflate, CJK collation, macOS system proxy 503 errors) into scripts and reference documentation, sparing callers from repeating mistakes.

Includes a closed loop of live self-tests and 'Verified' date maintenance; API drifts are exposed via FAIL lines rather than silent incorrect answers.

Universal input normalization (BVID/av/b23.tv/URL) with stable output schema (single JSON + pages[]), making downstream consumption straightforward.

Best for: Suitable for: Writers and analysts needing to cite verified Bilibili metrics for knowledge bases, case studies, or creator data validation; 'why this video went viral' content analysis; fetching danmaku, subtitles, and multi-part metadata for multi-part videos; and any moment when you are about to type a Bilibili view/like count into a document — fetch first, write second.

Not for: Not suitable for: Unattended batch automation requiring authenticated capabilities (subtitles and favorites-folder enumeration require user session authorization each time); ultra-large-scale scraping under strict platform anti-bot measures (requires compliance and rate limit evaluation); non-Bilibili platform data; scenarios requiring human-verified verbatim transcripts (ai-zh is only an AI-ASR draft track).

Install Agent-Ready

① Verified Mirror 2026-09-09

Option A · Direct DownloadDownload bilibili-source.tar.gz

sha256: 0274158c3549e867…

Option B · Copy Guide for Agent

install.json

Agents automatically download and verify mirrors from this JSON guide.

② Upstream GitHub

GitHub Repo ↗

Pinned to commit d5c4678cb5.