← Back to Skills Marketplace
kuangzhanzhiwang

Bilibili Garb

by kuangzhanzhiwang · GitHub ↗ · v1.0.1 · MIT-0
cross-platform ⚠ suspicious
102
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install bilibili-garb
Description
Bilibili garb (个性装扮) data collection and management. Search garb items, query suit/collection details, scan benefit data for owned items (including discontin...
README (SKILL.md)

Bilibili Garb (B站个性装扮)

Collect and manage Bilibili personalization items: garb suits, digital card collections, and benefit sub-items.

Setup

All authentication credentials are read from environment variables or a config file. Create configs/bili-api-creds.json in your workspace:

{
  "appkey": "27eb53fc9058f8c3",
  "appsecret": "\x3Cobtain from Bilibili mobile client>",
  "access_key": "\x3Cyour access_key>",
  "csrf": "\x3Cyour bili_jct>",
  "DedeUserID": "\x3Cyour uid>",
  "SESSDATA": "\x3Cyour SESSDATA>"
}

Or export environment variables:

export BILI_SESSDATA="\x3Cyour SESSDATA>"
export BILI_ACCESS_KEY="\x3Cyour access_key>"
export BILI_CSRF="\x3Cyour bili_jct>"
export BILI_UID="\x3Cyour uid>"

How to obtain credentials: Capture from Bilibili mobile app HTTP traffic (e.g., mitmproxy, Charles). The access_key expires periodically and must be refreshed.

Commands

Search Garb Items

bash scripts/bilibili-garb-search.sh "关键词"

Searches both the official API and a local gallery database. Outputs Markdown with:

  • Collection items (收藏集) with biz_id
  • Suit items (套装) with item_id
  • Discontinued items from local gallery marked [藏馆-绝版]

Query Collection/Suit Details

bash scripts/bilibili-garb-collection.sh -i \x3CID>
  • ID ≤ 6 digits → collection (收藏集) mode
  • ID > 6 digits → suit (套装) mode
  • Falls back to local gallery database for discontinued items

Scan Benefit Data

python3 scripts/garb-benefit-scan.py [options]

Scans owned garb items from data/decorations-database.json, calls benefit API for each, and appends results to data/garb-benefit-results.ndjson.

Options:

  • --limit N — process only N items
  • --dry-run — show what would be scanned without making API calls
  • --force — rescan items that already have benefit data
  • --debug — output full API responses

Supports resume (Ctrl+C safe) and deduplication.

Key API Knowledge

See references/bilibili-garb-api-reference.md for full API documentation.

Critical points:

  1. Benefit API (/x/garb/v2/user/suit/benefit) is the only way to get data for discontinued items. Requires sign authentication.
  2. DIY suits: When item_id contains a hyphen (e.g., 1775103232001-0), pass biz_id as the item_id parameter instead — the original item_id returns -400.
  3. part parameter: Only one call with part=space_bg returns all 9 sub-item types. No need to iterate.
  4. Scarcity tiers: Use item_list API's scarcity field as the primary source. When scarcity_rate=2 and rate2_count==1, default to small-hidden (30), do not auto-upgrade to large-hidden.
  5. DLC avatar frames: Must come from lottery_home_detail, never from collection's own frame/frame_image.

Standard Operating Procedure

See references/bilibili-garb-sop.md for step-by-step workflows.

Usage Guidance
This skill appears to do what it says (query Bilibili garb APIs, use local gallery DBs, and write NDJSON results), but there are two practical concerns to weigh before installing: (1) It needs highly sensitive Bilibili credentials (access_key, SESSDATA, bili_jct, appsecret). Those give access to user-specific API data; treat them like passwords and only run the scripts on a trusted machine. (2) The SKILL.md explicitly tells you to capture credentials from the mobile app via mitmproxy/Charles. That technique works for obtaining tokens but is sensitive and can capture other users' secrets if misused—only proceed if you control the account and understand the legal/ethical implications. Additional checks you can do: inspect the scripts line-by-line (they call only api.bilibili.com and write local files), ensure credentials are stored securely (not world-readable), run the tools in an isolated environment, and consider rotating or revoking tokens after use. The metadata omission (no declared env vars/primary credential) is a red flag—ask the publisher to list required credentials explicitly or provide a signed provenance for the package. If the author can provide justification for not declaring env vars or a trusted source/homepage, that would reduce concern.
Capability Assessment
Purpose & Capability
The name/description match what the scripts do: search, query, and scan Bilibili 'garb' endpoints and local gallery DBs. However, the registry metadata declares no required environment variables or primary credential while the SKILL.md and scripts clearly require sensitive Bilibili credentials (access_key, SESSDATA, bili_jct, appsecret). The credentials are relevant to the functionality but their absence from the declared requirements is an inconsistency.
Instruction Scope
The runtime instructions and scripts instruct the user/agent to read local workspace files (configs/bili-api-creds.json, data/decorations-database.json, optional local card/suit DB files) and to perform authenticated calls to Bilibili APIs. Critically, the SKILL.md explicitly advises obtaining credentials by capturing mobile-app traffic with mitmproxy/Charles—this is sensitive operational guidance that goes beyond routine setup and could be misused. The scripts themselves call only official api.bilibili.com endpoints and write results locally (ndjson/progress files), so there is no obvious hidden exfiltration endpoint, but the instructions for harvesting credentials are high-risk.
Install Mechanism
No install spec is provided (instruction-only with included scripts). Nothing is downloaded or installed by an automated installer; code is run locally. This is lower risk than arbitrary network installs, but running included scripts still executes code on the host.
Credentials
The skill requires high-sensitivity secrets used to authenticate as a Bilibili user (access_key, SESSDATA, bili_jct, appsecret). Those are proportionate to calling signed Bilibili endpoints, but the package metadata did not declare these required env vars or a primary credential. The instruction to capture these secrets via network interception increases risk. Users should assume possession of full account-level access is needed for the script to function and so must protect these secrets accordingly.
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. It reads/writes files within its workspace (data/, configs/) but does not attempt to modify other skills or system-wide settings.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install bilibili-garb
  3. After installation, invoke the skill by name or use /bilibili-garb
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
Add Apache-2.0 license
v1.0.0
Initial release: search garb items, query collection/suit details, benefit scan for discontinued items, scarcity tier detection
Metadata
Slug bilibili-garb
Version 1.0.1
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 2
Frequently Asked Questions

What is Bilibili Garb?

Bilibili garb (个性装扮) data collection and management. Search garb items, query suit/collection details, scan benefit data for owned items (including discontin... It is an AI Agent Skill for Claude Code / OpenClaw, with 102 downloads so far.

How do I install Bilibili Garb?

Run "/install bilibili-garb" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Bilibili Garb free?

Yes, Bilibili Garb is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Bilibili Garb support?

Bilibili Garb is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Bilibili Garb?

It is built and maintained by kuangzhanzhiwang (@kuangzhanzhiwang); the current version is v1.0.1.

💬 Comments