critical
suspicious.generated_source_template_injection
- Location
- references/analytics.md:240
- Finding
- User-controlled placeholder is embedded directly into generated source code.
Ghost CMS
AdvisoryAudited by Static analysis on May 10, 2026.
Overview
Detected: suspicious.generated_source_template_injection
Findings (1)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
ConcernMedium Confidence
ASI02: Tool Misuse and ExploitationWhat this means
A mistaken or over-eager agent action could publish content, delete data, change subscribers, moderate public comments, or alter site administration.
Why it was flagged
This shows broad Ghost Admin API mutation and public-publishing authority. It is purpose-aligned and disclosed, but the registry metadata indicates model invocation is not disabled and capability tags were not derived, so these high-impact actions are not clearly bounded by enforced user control.
Skill content
Destructive Operations ... Create/update/delete posts, pages, tags ... Publish/unpublish/schedule posts (makes content public) ... Create/update/delete members, tiers, newsletters ... All POST, PUT, DELETE requests
Recommendation
Require explicit user confirmation for every publish, delete, user/member, billing/tier, webhook, and settings change; ensure the registered capability and invocation metadata matches the documented safety model.
ConcernHigh Confidence
ASI09: Human-Agent Trust ExploitationWhat this means
Users may believe the platform enforces explicit invocation when the submitted registry metadata does not show that protection.
Why it was flagged
This documented security claim conflicts with the registry flags supplied for the skill, which say disable-model-invocation is false and the agent can invoke the skill autonomously.
Skill content
Autonomous invocation disabled - Requires explicit user commands
Recommendation
Fix the published metadata so autonomous invocation is actually disabled, or remove the claim and document exactly when the agent may invoke the skill.
NoteHigh Confidence
ASI03: Identity and Privilege AbuseWhat this means
Anyone or any agent action using this key can read and modify content, users, members, comments, settings, and public publishing state.
Why it was flagged
The credential requirement is expected for Ghost Admin API management and is clearly disclosed, but it grants complete site authority.
Skill content
Ghost Admin API keys provide FULL access to your Ghost site ... Admin API keys have no scoping options ... There are no read-only keys.
Recommendation
Use a dedicated Ghost integration key, prefer staging for testing, store it securely, rotate it regularly, and revoke it immediately if the skill is removed or no longer trusted.
NoteHigh Confidence
ASI07: Insecure Inter-Agent CommunicationWhat this means
If used, a webhook could keep sending Ghost events to an external destination after the immediate task is complete.
Why it was flagged
Webhook management is documented as part of the API coverage. Creating or updating webhooks can establish persistent external data flows, so users should notice this boundary even though it is part of comprehensive Ghost administration.
Skill content
| Webhooks | List (GET) | Create (POST), Update (PUT), Delete (DELETE) | External integrations |
Recommendation
Treat webhook creation or modification as a high-impact action requiring explicit approval, destination review, and later cleanup verification.
NoteHigh Confidence
ASI04: Agentic Supply Chain VulnerabilitiesWhat this means
You may run local Node code and npm dependencies that are not represented by a formal install spec in the registry metadata.
Why it was flagged
The artifact set includes runnable scripts and npm setup, but the registry install/provenance metadata is incomplete. This is a supply-chain review note, not evidence of malicious behavior.
Skill content
Source: unknown ... No install spec — this is an instruction-only skill ... Code file presence 9 code file(s)
Recommendation
Review the repository, scripts, package.json, and package-lock before installation, and publish a proper install spec that matches the documented npm setup.