Security audit
Security checks for vulnerabilities and agentic risk
This Halo blog manager has a plausible purpose, but it can send a bearer token and post content to a hardcoded default site if the blog URL is not set, and it can delete posts with weak safeguards.
Review before installing. Set HALO_URL explicitly every time, use a least-privileged Halo token, revoke any token used without HALO_URL set, avoid deletion unless you can verify the target post, and prefer regenerating the lockfile from an HTTPS registry with updated dependencies.
halo.js:18Bearer Token and Blog Content Sent to an Undeclared Default Endpoint
package-lock.json:18Dependencies Locked to a Plaintext HTTP Package Mirror
The project pins axios 1.13.6, which the finding reports as having multiple advisories including SSRF/proxy-bypass and prototype-pollution-related issues. In a CLI or agent skill that makes outbound requests, such flaws can enable request forgery, credential leakage, response hijacking, or misuse of internal network access depending on how untrusted input is handled.
form-data 4.0.5 is reported as vulnerable to CRLF injection through unescaped multipart field names or filenames. If any untrusted input is incorporated into multipart requests, an attacker may manipulate request structure, inject headers, or interfere with downstream parsers.
The package declares axios 1.13.6, which the finding identifies as having multiple known advisories, including SSRF and man-in-the-middle/prototype-pollution-related issues. Because this skill appears to manage a blog platform and likely performs authenticated API requests, a vulnerable HTTP client can expose tokens, enable request hijacking, or allow malicious routing behavior depending on how the library is used.
The trigger list includes very broad terms such as "halo", "博客", and "发布文章", which can plausibly appear in normal conversation and cause unintended skill activation. Because this skill can perform state-changing actions against a live blog, accidental invocation could lead to unintended publication or follow-on destructive actions if the agent chains commands.
The documentation advertises deletion capability and even shows a deletion command, but it does not warn that the action is destructive or recommend confirmation, preview, or safeguards. In an agent setting, this increases the chance that a user or automated workflow triggers irreversible content deletion based on ambiguous keywords or mistaken targeting.
The top-level doc comment says the tool is a "Halo Manager CLI" for "发布文章到Halo博客" and documents a three-step publish flow only. However, the implementation also exposes list and delete commands, including destructive deletion of post content, which contradicts the stated scope in the documentation rather than merely omitting an implementation detail.
The lockfile pins package tarballs to plain HTTP mirrors, which allows a network attacker or malicious intermediary to tamper with downloaded packages despite the presence of integrity hashes. In many package-manager and CI workflows, integrity verification may be bypassed, disabled, or replaced during updates, and use of insecure transport materially increases supply-chain compromise risk.
Additional dependency entries also reference plain HTTP package sources, showing the issue is systemic rather than isolated. This broadens exposure to dependency tampering or mirror impersonation during install and update operations.
Multiple entries in the lockfile rely on an unsecured HTTP mirror, creating a recurring software supply-chain weakness. If an attacker can intercept traffic or control DNS/routing, they may deliver altered packages or disrupt builds.
follow-redirects 1.15.11 is reported as leaking custom authentication headers across cross-domain redirects. If this skill sends authenticated HTTP requests and follows attacker-influenced redirects, secrets such as API tokens could be exposed to a different host.
qs 6.15.0 is flagged for several denial-of-service issues involving crafted input during query-string parsing or serialization. The practical risk depends on whether this skill parses attacker-controlled query structures or serializes untrusted nested objects, but the dependency is still vulnerable on its face.
The description string is written only in Chinese ("Halo博客管理技能"), which indicates a fixed language choice with no indication that users can select their preferred language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
The dependency uses a caret range (^2.22.0), which allows automatic installation of newer compatible releases. This weakens build reproducibility and can unexpectedly pull in a compromised or breaking upstream version, increasing supply-chain risk for anyone installing the skill.
"author": "",
"license": "ISC",
"dependencies": {
"@halo-dev/api-client": "^2.22.0",
"axios": "^1.13.6"
}
}
The axios dependency is specified with a caret range (^1.13.6), so installs are not fully deterministic and may resolve to different future patch/minor versions. In the context of a network-facing blog management skill, this increases supply-chain exposure because a malicious or flawed upstream release could affect HTTP request handling and credential-bearing traffic.
"license": "ISC",
"dependencies": {
"@halo-dev/api-client": "^2.22.0",
"axios": "^1.13.6"
}
}