ClawHub
Back to skill

Security audit

BCMS Content

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent BCMS content CLI, but it needs Review because it can mutate or delete CMS content with an API key while carrying supply-chain and invocation risks.

Install only if you trust the BCMS package source and are comfortable granting the agent a least-privilege BCMS key. Prefer running the checked-in local CLI, avoid unpinned npx use, review or update the flagged dependencies, and require human confirmation before production deletes or publishes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Known Vulnerable Dependency: axios==1.17.0 — 10 advisory(ies): CVE-2026-67313 (Axios: Excessive recursion in formDataToJSON can cause denial of service); CVE-2026-67319 (Axios: Nested axios option objects can consume polluted prototype values); CVE-2026-67315 (Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios) +7 more

High
Category
Supply Chain
Confidence
98% confidence
Finding

Axios 1.17.0 is directly included through @thebcms/client and carries multiple advisories affecting request handling, proxy behavior, and denial-of-service conditions. Because this skill is a CLI for content operations using a high-privilege BCMS API key and making outbound HTTP requests in CI and agent workflows, weaknesses in the HTTP client are more dangerous here than in an isolated local-only tool.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
95% confidence
Finding

form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names, which can enable malformed multipart requests or header injection when attacker-controlled names or filenames are passed into upload logic. This skill explicitly supports media upload and automated content operations, so if any agent- or workflow-supplied metadata reaches multipart construction, the issue is especially relevant.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill documents use of environment-sourced credentials (BCMS_API_KEY) and a destructive CLI, but the frontmatter declares no explicit tool scope or permissions boundary. In agent environments, missing scope metadata can cause the skill to be invoked with broader access than reviewers or orchestrators expect, increasing the chance of unintended secret use or destructive content operations.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
# BCMS Content CLI

**Canonical copy:** edit this file at `ai/skills/bcms-content/SKILL.md`. The Claude Code and Cursor plugins package the same file via symlinks under `ai/providers/*/plugin/skills/bcms-content/`.

This skill ships a small executable CLI (`cli/bcms.mjs`) for **content operations**: create / update / delete / list entries and upload media. It wraps the official **`@thebcms/client`** SDK so entry `meta` is converted to the raw props the backend expects (raw REST calls do not do this).

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The instruction to run npx bcms-content without a pinned version permits fetching and executing whatever package version is current at invocation time. In CI or agent workflows this creates a supply-chain risk: a compromised, typosquatted, or unexpectedly changed package could execute arbitrary code with access to the BCMS API key and local environment.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
## Safety

- **Never hard-code or commit API keys.** Use `BCMS_API_KEY` from the environment; prefer least-privilege scoped keys (`references/permissions.md`).
- **`delete-entry` is irreversible.** Confirm the id with `list-entries` first, and avoid deletes against production without checking impact.
- Use separate keys per environment (dev / staging / production).

Deeper references are bundled under `references/` (entries, media, properties, permissions, MCP). Change history: `ai/CHANGELOG.md`.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==9.0.1 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The lockfile pins a transitive copy of uuid to 9.0.1, which is flagged for a missing buffer bounds check in certain namespace-based UUID generation paths when a caller supplies a buf argument. In this skill, the package is only a dependency of @thebcms/utils, so exploitability depends on whether that library exposes attacker-controlled inputs into the affected API; that makes the practical risk lower, but the vulnerable version is still present.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json
"node": ">=20"
  },
  "dependencies": {
    "@thebcms/client": "^2.0.0"
  }
}

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
cli/bcms.mjs:8

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:31