ClawHub
Back to skill

Security audit

typecho-publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Typecho blog management helper with sensitive but purpose-aligned blog and token access.

Install only if you intend this agent to manage a Typecho blog. Treat the Typecho token like a password, store it carefully, use a least-privileged blog account, review posts before publishing, and require explicit confirmation before updates or deletions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Vague Triggers

High
Confidence
97% confidence
Finding
L003 将“发博客”“归档”“知识库”“我的博客”等都列为触发信号，并表述为“均应使用”，但没有限定具体操作上下文或排除条件。其中“归档”“知识库”“我的博客”都可能出现在普通对话中，容易导致该技能在并非要操作 Typecho 时被调用。

Missing User Warnings

Medium
Confidence
86% confidence
Finding
L024-L033 指导用户把 `token` 写入 `~/.config/typecho-cli/config.json`，并允许通过环境变量传入，但未提醒这是敏感凭据、应限制文件权限、避免提交到版本控制或泄露到共享环境。该技能会直接使用凭据管理博客内容，属于应向用户明确提示的敏感操作。

Natural-Language Policy Violations

Medium
Confidence
78% confidence
Finding
L003 的说明全文以中文固定描述技能行为，且未声明可根据用户偏好切换语言或由用户选择输出语言。按规则，若技能对语言或 locale 施加强制约束而没有用户 opt-in，应视为自然语言政策风险。

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The delete command sends a deletion request for a post and immediately exits with the API result, but there is no confirmation prompt, cautionary print/log message, or inline warning comment/docstring describing the destructive effect. For a code file, destructive or irreversible operations should include some form of user disclosure unless already clearly warned elsewhere in markdown, which is not present in this file.

Natural-Language Policy Violations

Low
Confidence
88% confidence
Finding
The script's natural-language interface, including the module docstring and command help text, is presented in Chinese only, with no option to select another language or indication that the tool is intentionally region-specific. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clear justification.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
# 2. 环境变量
    domain = os.environ.get("TYPECHO_DOMAIN", domain)
    token = os.environ.get("TYPECHO_TOKEN", token)

    # 3. 命令行参数
    if getattr(args, "domain", None):
Confidence
70% confidence
Finding
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Static analysis

No suspicious patterns detected.