Security audit

Halo Blog

Security checks for vulnerabilities and agentic risk

Overview

The skill is meant to manage a Halo blog, but its publishing helper can run unexpected local code and its docs under-warn users about destructive blog operations.

Review carefully before installing. Pin npm dependencies, avoid the publishing script for untrusted Markdown, do not pass real tokens or passwords in shared command lines, verify the active Halo profile before running `--force` or `--all --yes`, and keep backups before content or plugin changes.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/md-to-html-post.sh:42
Finding: Python Code Injection Through Untrusted Publication Parameters
Content: View full analysis
/dev/null; then ``` ### Technical Analysis The script interpolates `PROFILE`, `TITLE`, and `SLUG` directly into source code supplied to `python3 -c`. The title and slug originate in a potentially untrusted Markdown file, while the profile is a command-line argument. Shell quoting around the outer Python program does not make these values safe Python literals. An attacker can include a single quote and a valid Python expression in a front-matter value. After interpolation, that expression becomes executable Python code. For example, a title shaped like the following can cause an operating-system command to run while remaining syntactically valid inside the argument list: ```yaml title: "x' + __import__('os').popen('id').read() + 'y" ``` The simple `sed` operations only remove surrounding quote characters. They do not perform Python string escaping or YAML-aware validation. ### Attack Path 1. An attacker prepares a Markdown document containing a malicious `title` or `slug` front-matter value. 2. A user or automation in ...[truncated 872 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/md-to-html-post.sh:33
Finding: Runtime Retrieval and Execution of an Unpinned npm Dependency
Content: View full analysis
HTML if npx marked "$TMP_DIR/body.md" > "$TMP_DIR/body.html" 2>/dev/null; then HTML_MODE=true else echo "Warning: HTML conversion failed, falling back to Markdown import." HTML_MODE=false fi ``` The same unsafe workflow is recommended in `references/publishing.md`, lines 11–14: ```bash # 去掉 front matter，正文转成 HTML sed '1,/^---$/d' article.md | sed '1{/^---$/d}' > body.md npx marked body.md > body.html ``` ### Technical Analysis The command invokes `npx marked` without a project lockfile, an exact package version, an integrity value, or `--no-install`. Depending on the local environment and npm configuration, `npx` can retrieve the package dynamically when it is not already installed. This makes the effective code executed by the skill mutable after review. A compromised upstream release, registry account, package-resolution change, or malicious registry configuration could cause attacker-controlled package code to execute locally. Suppressing standard error also hides installation warnings and other diagnostic information that could alert a user to unexpected dependency retrieval. ### Attack Path 1. The expected `marked` executable is absent from the local npm cache or project. 2. A user invokes the publication script. 3. `npx` resolves `marked` through the configured npm registry. 4. A mutable, compromised, or otherwise unexpected package release is downloaded. 5. Package-controlled code executes under the invoking user's account. 6. The compromised process can access local files, environment variables, and credentials available to that user. ### Impact Assessment A successful supply-chain compromise can provide arbitrary code execution with the invoking user's privileges. This can affect local files, publication content, Halo p ...[truncated 228 chars]
Remediation: View remediation
"$TMP_DIR/body.html" ``` - Prefer a direct project-local path if appropriate: ```bash ./node_modules/.bin/marked "$TMP_DIR/body.md" > "$TMP_DIR/body.html" ``` - Verify package provenance and integrity during installation. - Do not suppress all dependency errors; preserve actionable diagnostics while avoiding leakage of sensitive values. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Unpinned Global Installation of the Halo CLI
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/md-to-html-post.sh:33
Finding: Untrusted Markdown Is Converted and Published as Raw HTML Without Sanitization
Content: View full analysis
"$TMP_DIR/body.html" 2>/dev/null; then HTML_MODE=true ``` ```bash if python3 -c " import subprocess, sys with open('$TMP_DIR/body.html', 'r', encoding='utf-8') as f: html = f.read() result = subprocess.run([ 'halo', 'post', 'create', '--profile', '$PROFILE', '--name', '$SLUG', '--title', '$TITLE', '--slug', '$SLUG', '--content', html, '--raw-type', 'html', '--publish', 'true' ], capture_output=True, text=True) ``` ### Technical Analysis The script converts the Markdown body to HTML and immediately submits the result as raw HTML with publication enabled. It does not reject embedded HTML, sanitize the generated output, or apply an explicit allowlist. Markdown processors can preserve raw HTML supplied in the source document. Consequently, a malicious document may introduce active HTML, event-handler attributes, dangerous URLs, or other browser-executable content into the publication pipeline. Actual browser exploitation also depends on Halo and the active theme's downstream sanitization behavior. The script nevertheless establishes no security boundary of its own and explicitly requests raw HTML publication. ### Attack Path 1. An attacker supplies or influences a Markdown file containing malicious embedded HTML. 2. The user publishes the file through `md-to-html-post.sh`. 3. `marked` converts the document and may preserve the embedded HTML. 4. The script submits the result using `--raw-type html`. 5. The post is created with `--publish true` and later made public. 6. If Halo or the active theme does not adequately sanitize the content, a visitor's browser executes the injected content. ### Impact Assessment Potential impact includes stored ...[truncated 435 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/publishing.md:112
Finding: Predictable Shared Temporary File in the Annotation Workflow
Content: View full analysis
--output /tmp/post.json python3 -c " import json with open('/tmp/post.json', 'r') as f: d = json.load(f) d['post']['metadata']['annotations']['ai_generated'] = 'true' d['post']['metadata']['annotations']['ai_generated_desc'] = '本文内容由 AI 辅助生成，已经人工审核和编辑。' with open('/tmp/post.json', 'w') as f: json.dump(d, f, ensure_ascii=False) " halo post import-json --file /tmp/post.json --force ``` ### Technical Analysis The documented workflow uses the fixed path `/tmp/post.json`. Shared temporary directories are accessible to other local processes, and predictable names create race-condition, collision, and symbolic-link risks. An attacker able to operate on the same host could prepare or replace the path before one of the workflow steps. Depending on the behavior of the exporting command and file permissions, this could redirect writes, alter the JSON imported with `--force`, or expose exported post data. The workflow also does not remove the file after use. Because this code appears in operational documentation, an AI agent or user following the skill can reproduce the unsafe pattern directly. ### Attack Path 1. A local attacker predicts that the workflow will use `/tmp/post.json`. 2. The attacker pre-creates the path, substitutes a symbolic link, or races a replacement between export, modification, and import. 3. The workflow reads or writes the attacker-controlled filesystem object. 4. Modified post JSON may be imported with `--force`, or an unintended writable target may be overwritten. 5. The exported content remains at the predictable location unless manually removed. ### Impact Assessment The direct scope is limited to permissions held by the user executing the workflow. Potential consequences include unauthorized modifica ...[truncated 296 chars]
Remediation: View remediation
--output "$POST_JSON" ``` The Python process should receive `POST_JSON` as an argument rather than embedding the path into source code. ]]>

other

Note

Location: scripts/md-to-html-post.sh:63
Finding: Hard-Coded Publication URL Misrepresents the Selected Halo Profile
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents shell-capable CLI usage and references local file inputs, but the manifest does not declare any tool scope such as allowed-tools or permissions. In an agent environment, that weakens least-privilege boundaries and can let the skill be invoked with broader shell or file access than reviewers or orchestrators expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The workflow examples include bulk upgrade and force-enabled import operations that can change production content or installed components, but they are presented without prominent warnings about irreversible effects, staging-first guidance, or backup prerequisites. In a CLI skill intended for automation, this increases the chance of accidental mass changes or outages from routine agent execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file includes force-delete examples for posts, categories, tags, and single pages using --force, but it does not warn the user that these commands are destructive and may permanently remove content. Under the markdown-file criteria, behaviors affecting user data or system integrity should be accompanied by warnings.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file includes forced deletion commands for comments using --force, but the surrounding documentation does not warn that the action is destructive or irreversible. Under the markdown-specific missing-warning rule, user-facing skill documentation should disclose behaviors that may affect user data or system integrity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The reply management examples include halo comment reply delete ... --force without any nearby caution that the operation deletes user data. Markdown skill instructions should warn users when documented commands can irreversibly remove content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The notification section includes a forced delete command but does not warn that it permanently removes a notification. The markdown guidance therefore omits a user warning for an operation affecting user data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file lists forceful destructive operations such as halo theme delete <name> --force without accompanying warning text about deletion impact or irreversibility. Similar destructive examples appear elsewhere in the document, but the description does not clearly warn users that these commands can remove themes, plugins, attachments, backups, or moments immediately.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The example halo plugin upgrade --all --yes explicitly bypasses confirmation for bulk changes, but the surrounding documentation does not warn about the risk of unattended upgrades affecting multiple plugins at once. For markdown files, omission of warnings about behaviors that can affect system integrity or availability is in scope.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The document instructs users to run npx marked without pinning a specific package version, which allows installation of whatever version is currently resolved from the registry at execution time. This creates a supply-chain risk: a malicious or compromised upstream release, typosquat, or unexpected breaking change could execute arbitrary code in the user's environment when publishing content.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: This finding refers to the same unsafe guidance: fallback behavior and publishing instructions still depend on npx marked without version pinning. Because npx may fetch and execute remote package code on demand, the skill increases exposure to registry compromise or malicious package updates during routine blog operations.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The script executes npx marked without pinning an exact package version, which allows npm to resolve and run whatever marked version is available from the registry or local environment at execution time. In a publishing automation skill, this creates a supply-chain risk: a compromised upstream package, typo-squatted package resolution, or unexpected major-version behavior could lead to arbitrary code execution on the operator's machine or CI runner before blog content is published.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The authentication example instructs users to pass a bearer token directly on the command line without warning that CLI arguments may be exposed through shell history, process listings, logs, or agent transcripts. In an automation context, this can lead to credential leakage and unauthorized access to the Halo instance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation shows credential-bearing CLI examples using bearer tokens and passwords directly on the command line without warning that shell history, process listings, terminal logging, or screen sharing may expose secrets. In an authentication-focused skill, this is a real security weakness because users are likely to copy-paste the examples as-is when connecting to production blog instances.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The documentation shows creation of an Internal note reply with --hidden, but it does not explain who can view hidden replies or their privacy implications. For markdown files, behaviors that may affect user privacy or moderation handling should be disclosed clearly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The example halo notification mark-as-read --all changes the read state of all notifications, but the documentation does not call out the scope of this bulk action. Even though not destructive, markdown guidance should warn when commands make broad user-data changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The operational instructions are written entirely in Chinese, and the file does not indicate that the skill is intentionally limited to Chinese-speaking users or provide an opt-in language choice. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire skill file presents instructions exclusively in Chinese, and there is no note that the language is optional or targeted to a specific locale. This can violate a language-choice policy when users are not given an explicit option to use another language.
Content: No source excerpt is available for this finding.