Halo博客管理，文章发布

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 1.0.0

Overview

This Halo blog manager matches its stated purpose, but it can use a personal access token against a hard-coded default site and delete matching posts without confirmation.

Review before installing. Set HALO_URL explicitly to your own Halo site, use a least-privilege token, and avoid the delete command unless you have independently confirmed the exact post it will remove. Consider regenerating the lockfile with HTTPS registry URLs and upgrading or reviewing axios before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger set includes very broad terms such as "halo" and generic blog-related words, which can cause the skill to activate in contexts the user did not intend. Because this skill can publish and delete blog posts, accidental invocation increases the chance of unintended content changes or deletions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill advertises deletion capability without any visible warning that the action is destructive or may cause permanent data loss. In a content-management context, this omission makes accidental or socially engineered use more likely, especially if users assume all listed capabilities are equally safe to try.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The usage example shows `halo delete "关键词"` without any caution, scope clarification, or confirmation requirement, which normalizes a destructive command as routine usage. If invoked accidentally or with an ambiguous keyword, the skill may delete the wrong article and cause irreversible content loss.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The delete command permanently removes post content based on a keyword search and immediately deletes the first match without confirmation, dry-run output, or strong disambiguation. In a CLI that operates with a bearer token against a live blog, this increases the chance of accidental destructive actions and can lead to unintended data loss if a user mistypes or supplies a broad keyword.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The lockfile pins package downloads to a plain-HTTP mirror URL, which removes transport integrity and server authentication during dependency retrieval. Even though npm lockfiles include integrity hashes, using unauthenticated HTTP still creates supply-chain risk through mirror tampering, dependency availability manipulation, metadata interception, and weaker trust guarantees in automated or misconfigured install environments.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The repeated use of the same region-specific plain-HTTP mirror across additional dependencies shows this is not an isolated artifact but a systematic source policy embedded in the lockfile. That increases the blast radius of a compromised or intercepted mirror, allowing an attacker to influence multiple package fetches in the dependency chain and undermining software supply-chain trust.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "",
  "license": "ISC",
  "dependencies": {
    "@halo-dev/api-client": "^2.22.0",
    "axios": "^1.13.6"
  }
}

• Confidence: 90% confidence
• Finding: "@halo-dev/api-client": "^2.22.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "ISC",
  "dependencies": {
    "@halo-dev/api-client": "^2.22.0",
    "axios": "^1.13.6"
  }
}

• Confidence: 95% confidence
• Finding: "axios": "^1.13.6"

Known Vulnerable Dependency: axios==1.13.6 — 10 advisory(ies): CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF); CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `pars); CVE-2026-42037 (Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in f) +7 more

High

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: axios==1.13.6

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: halo.js:17