Blogburst 3.1.2

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:52 AM UTC
• Version: 1.0.0

Overview

This skill is a real marketing API integration, but it needs Review because it can expose its API key and enable automatic public social-media actions with weak guardrails.

Review this carefully before installing. Use a secret manager or temporary environment variable instead of echoing or saving the API key in ~/.zshrc, and rotate the key if it has already appeared in command output or logs. Only connect social accounts you are comfortable letting BlogBurst manage, and require previews or explicit confirmation before enabling auto-pilot, posting, replying, liking, following, or running automation now. Expect prompts, draft content, account state, analytics, and marketing data to be sent to BlogBurst's API.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:10

Finding

Mandatory API Key Disclosure Through Command Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-15
Vulnerability Type: API credential exposure through insecure diagnostic command
Risk Level: High

Vulnerable Code

markdown

## CRITICAL INSTRUCTION — YOU MUST FOLLOW THIS:

### Step 1: Check API Key
Before doing ANYTHING, run: `echo $BLOGBURST_API_KEY`

**If the output is empty or the variable is not set**, do NOT proceed with API calls.

Technical Analysis

The Skill requires the agent to print the complete value of BLOGBURST_API_KEY merely to determine whether the variable is configured. This violates secret-handling best practices because the value can enter tool output, agent context, conversation transcripts, telemetry, execution logs, or monitoring systems.

Printing the value is unnecessary. The Skill only needs a Boolean existence check, which can be performed without revealing the credential.

Attack Path

1. A user configures a valid BLOGBURST_API_KEY in the agent environment.
2. The user invokes the BlogBurst Skill.
3. The Skill instructs the agent to execute echo $BLOGBURST_API_KEY.
4. The complete credential is returned in tool output.
5. The credential may be retained in a transcript, log, agent context, telemetry system, or debugging interface.
6. An actor with access to that output can reuse the key against the BlogBurst API.

Impact Assessment

Exposure of the API key may permit unauthorized access to account-specific BlogBurst data and functions available to that credential. Based on the documented API capabilities, this may include reading analytics and configuration, generating content, changing auto-pilot settings, initiating automated posting, and performing other marketing actions associated with the user's account.

The exact scope depends on the server-side permissions assigned to the exposed API key. No evidence of access beyond the BlogBurst account or API permissions was found.

Remediation

View remediation

Remediation Suggestions

• Never print API keys or other secrets during setup or validation.

• Replace the command with a non-disclosing existence check, for example:

  bash

  if [ -n "${BLOGBURST_API_KEY:-}" ]; then
    printf '%s\n' "BLOGBURST_API_KEY is configured"
  else
    printf '%s\n' "BLOGBURST_API_KEY is not configured"
  fi
  

• Redact credentials from agent transcripts, command logs, telemetry, and error reports.

• Ensure API keys are narrowly scoped and support expiration and rotation.

• Advise users to rotate the key immediately if it has already appeared in tool output or logs.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:26

Finding

Persistent Plaintext API Key Storage in Shell Startup File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-29
Vulnerability Type: Plaintext credential storage and unsafe persistent configuration modification
Risk Level: Medium

Vulnerable Code

markdown

6. Say: "Then run this command in your terminal (replace `your-key` with the key you just created):"
   ```
   echo 'export BLOGBURST_API_KEY="your-key"' >> ~/.zshrc && source ~/.zshrc
   ```

Technical Analysis

The documented setup command stores a long-lived API key in plaintext inside ~/.zshrc. Shell startup files are frequently included in backups, copied between systems, shared for troubleshooting, or read by other processes operating under the same user account.

The command also appends a new assignment without checking for an existing entry. Repeated execution can leave multiple stale credentials in the file. Immediately sourcing the entire startup file also executes all commands already present in it, even though only an environment variable update is required.

This behavior persists the credential across sessions, but it does not install a backdoor, startup service, or attacker-controlled persistence mechanism. It is therefore classified as insecure secret storage rather than system persistence.

Attack Path

1. A user replaces your-key with a valid BlogBurst API key.
2. The command appends the key in plaintext to ~/.zshrc.
3. The file remains on disk across terminal and agent sessions.
4. A local process, another user with sufficient file access, a compromised backup, or an accidentally shared dotfile obtains the key.
5. The exposed key is reused to access the BlogBurst API within its assigned permissions.

Impact Assessment

An attacker who obtains the plaintext key may exercise the BlogBurst account capabilities authorized to that credential. The documented capabilities include access to analytics, marketing configuration, generated content, task infor ...[truncated 177 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer an operating-system credential manager, OpenClaw secret store, or another dedicated secret-management facility.
• Do not instruct users to place API keys directly in versionable or routinely shared shell configuration files.
• If a protected environment file is unavoidable, create it with restrictive permissions such as mode 0600 and ensure it is excluded from version control and backups where appropriate.
• Check for and update an existing configuration entry rather than blindly appending duplicate values.
• Avoid sourcing the user's complete shell startup file as part of credential setup.
• Document key rotation and revocation procedures.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:36

Finding

Coercive Tool-Control Instructions Override Safer Agent Behavior

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-39
Vulnerability Type: Skill instruction hijacking through absolute tool-selection directives
Risk Level: Medium

Vulnerable Code

markdown

### Step 2: Make API Calls
When `$BLOGBURST_API_KEY` is set, you MUST use the `exec` tool to run `curl` commands against the BlogBurst API. Do NOT use web_search or any other tool as a substitute. The API returns real user-specific data (their posts, their analytics, their auto-pilot status). Web search cannot provide this.

**How to execute:** Use `exec` with `curl -s "https://api.blogburst.ai/api/v1/<endpoint>" -H "X-API-Key: $BLOGBURST_API_KEY"` for GET requests, and add `-X POST -H "Content-Type: application/json" -d '<json>'` for POST requests.

Technical Analysis

The Skill uses absolute directives such as “MUST” and “Do NOT use ... any other tool” to constrain the agent's tool selection. These instructions are combined with an earlier “CRITICAL INSTRUCTION” requiring execution before any other action.

A Skill may legitimately document its required API, but it should not attempt to override platform safety controls, safer credential-handling mechanisms, user-confirmation requirements, or policy-driven tool selection. Requiring generic shell execution also creates a broader execution surface than a dedicated, parameterized HTTP client would require.

The supplied curl examples interpolate the API key only into a quoted header and do not, by themselves, demonstrate command injection. The confirmed concern is the attempt to displace safer agent behavior and force shell-mediated communication.

Attack Path

1. The Skill is loaded into an agent session.
2. Its absolute-priority language directs the agent to disregard alternative tools and use exec.
3. The agent executes shell commands and submits authenticated requests to the designated third-party API.
4. For state-changing endpoi ...[truncated 779 chars]

Remediation

View remediation

Remediation Suggestions

• Replace absolute priority language with narrowly scoped operational guidance.
• Explicitly state that platform safety policies, secret-handling requirements, and user authorization take precedence.
• Use a dedicated HTTP tool or parameterized API integration instead of generic shell execution where available.
• Require explicit user confirmation before state-changing actions such as publishing content, enabling auto-pilot, replying, liking, following, or completing tasks.
• Distinguish read-only endpoints from state-changing endpoints and apply stronger confirmation requirements to the latter.
• Limit transmitted conversation history and user content to the minimum necessary for each request.
• Clearly disclose that authenticated data and user-supplied content are sent to the BlogBurst service.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README materially understates the capability and risk profile of the skill compared with the manifest metadata. Presenting an autonomous marketing agent as a narrower content-generation tool can mislead reviewers and users about behaviors such as automated posting, engagement, community scanning, and optimization, which affects informed consent and security review scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

md

## Links

- Website: [blogburst.ai](https://blogburst.ai)
- API Docs: [api.blogburst.ai/docs](https://api.blogburst.ai/docs)
- Support: [e-mail]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

## Links

- Website: [blogburst.ai](https://blogburst.ai)
- API Docs: [api.blogburst.ai/docs](https://api.blogburst.ai/docs)
- Support: [e-mail]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 549)May include surrounding context.

md

## Links

- Website: [blogburst.ai](https://blogburst.ai)
- API Docs: [api.blogburst.ai/docs](https://api.blogburst.ai/docs)
- Support: [e-mail]

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill tells the user to append the API key export to ~/.zshrc, creating persistent credential storage in a shell startup file. This increases exposure because long-lived secrets may be inherited by future shells, leaked through debugging/history/workstation compromise, or remain after the user no longer intends the integration to be active.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

• "Twitter/X — one-click OAuth, takes 5 seconds. I can auto-post, reply to mentions, like, and follow relevant accounts for you."
  • "Bluesky — enter your handle and app password. I'll auto-post and engage there too."
  • "Telegram / Discord — paste your bot token. I'll broadcast to your channels."

5. Say: "Step 4 — Get your API key. You can only create a key after completing Steps 2-3. Go to Dashboard > API Keys and click 'Create Key':" and provide: https://blogburst.ai/dashboard/api-keys
6. Say: "Then run this command in your terminal (replace your-key with the key you just created):"

   text

   echo 'export BLOGBURST_API_KEY="your-key"' >> ~/.zshrc && source ~/.zshrc
   

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill explicitly instructs sending an authenticated request containing the user's API key to an external service for verification. External transmission is expected for this integration, but it remains security-relevant because it moves account-linked data off-platform and should be disclosed and consented to.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

echo 'export BLOGBURST_API_KEY="your-key"' >> ~/.zshrc && source ~/.zshrc

text

7. Say: "After that, restart OpenClaw or run `source ~/.zshrc`, then try `/blogburst` again!"
8. If the user says they've done it, verify by running: `curl -s "https://api.blogburst.ai/api/v1/usage" -H "X-API-Key: $BLOGBURST_API_KEY"`
9. If successful, say: "All set! Try these:"
- "/blogburst turn on auto-pilot — I'll post 3x/day and engage with your audience automatically"
- "/blogburst generate a post about [your topic]"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill explicitly instructs sending an authenticated request containing the user's API key to an external service for verification. External transmission is expected for this integration, but it remains security-relevant because it moves account-linked data off-platform and should be disclosed and consented to.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

echo 'export BLOGBURST_API_KEY="your-key"' >> ~/.zshrc && source ~/.zshrc

text

7. Say: "After that, restart OpenClaw or run `source ~/.zshrc`, then try `/blogburst` again!"
8. If the user says they've done it, verify by running: `curl -s "https://api.blogburst.ai/api/v1/usage" -H "X-API-Key: $BLOGBURST_API_KEY"`
9. If successful, say: "All set! Try these:"
- "/blogburst turn on auto-pilot — I'll post 3x/day and engage with your audience automatically"
- "/blogburst generate a post about [your topic]"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill prominently promotes autonomous posting, replying, liking, and following without an explicit warning that these are live actions against connected third-party accounts. In context, this is more dangerous because the actions can affect public brand presence, spam users, or cause reputational and platform-policy harm if triggered unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to send user-specific data to an external API but does not present a clear disclosure that prompts, content, analytics, and account metadata will leave the local environment. Because the API is positioned as the primary path for most requests, users may unknowingly expose sensitive business or social-account information.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The skill mandates using exec with curl for all requests to the vendor API and states that real user-specific data will be returned. This is a true external-transmission concern because prompts, account state, analytics, and automation commands may be sent or retrieved without any built-in consent, scoping, or redaction controls.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

### Step 2: Make API Calls
When `$BLOGBURST_API_KEY` is set, you MUST use the `exec` tool to run `curl` commands against the BlogBurst API. Do NOT use web_search or any other tool as a substitute. The API returns real user-specific data (their posts, their analytics, their auto-pilot status). Web search cannot provide this.

**How to execute:** Use `exec` with `curl -s "https://api.blogburst.ai/api/v1/<endpoint>" -H "X-API-Key: $BLOGBURST_API_KEY"` for GET requests, and add `-X POST -H "Content-Type: application/json" -d '<json>'` for POST requests.

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises very broad natural-language triggers such as helping with 'anything complex' or 'help me with my social media,' which can cause the agent to invoke this skill for loosely related requests. That increases the chance of unintended API use and account-affecting actions without a clear, narrow activation boundary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The API examples specify "language": "en", and the document repeatedly presents English as the default interaction language without explicitly offering a user language choice. This can amount to a language-policy issue when a skill implicitly forces a locale rather than making it configurable or user-selected.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.