Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent BuildStack website-management integration, but it can publish or modify live public websites through an API key without consistently requiring an explicit preview or confirmation step.
Install only if you trust BuildStack with the business details and website content you ask the agent to publish. Store BUILDSTACK_API_KEY in a secret or environment variable, do not paste it into casual chat, and require the agent to show a preview or summary and get your explicit approval before creating sites, publishing articles, changing domains, or modifying live pages.
The README advertises one-shot site creation, content management, and maintenance actions without clearly warning that these operations may create or modify public-facing assets. In an agent-integrated skill, this can cause users to trigger irreversible or externally visible changes through natural-language prompts they may perceive as exploratory rather than operational.
The quick-start phrase encourages users to say a single sentence to build a site, but it does not disclose that this may invoke real deployment actions against an external service. In the context of AI agents, this increases the risk of unintended live site creation, accidental consumption of quotas, or publication of incomplete or sensitive business details.
The content-management examples present publishing actions as conversational commands without warning that they may immediately alter a live website. This is dangerous because users may test phrasing or draft content through the agent and unintentionally push public changes to production-facing pages.
The skill enables creation, modification, publishing, and SEO rebuild operations that directly affect live websites, but it does not instruct the agent to obtain explicit confirmation before performing state-changing actions. In an agent context, this can cause unintended production changes, accidental publishing, or destructive edits from ambiguous user requests.
The skill instructs users to create and supply an API key but does not warn against exposing it in chat, logs, screenshots, or client-side code, nor does it describe least-privilege or rotation practices. Because the key authorizes live website operations, leakage could let an attacker create, modify, or publish content on the user's sites.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 列出可用模板（按行业筛选）
curl -s https://buildstack.com.cn/api/v1/skills?industry=education \
-H "Authorization: Bearer $BUILDSTACK_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 获取站点所有内容块
curl -s https://buildstack.com.cn/api/v1/sites/{site_id}/blocks \
-H "Authorization: Bearer $BUILDSTACK_API_KEY"
# 更新 hero 区域
The example shows the agent generating and publishing a public website to a live URL immediately after an API call, without an explicit confirmation step or warning that the action will make content publicly accessible. In an agent context, this increases the risk of unintended publication of inaccurate, sensitive, copyrighted, or reputationally damaging material because users may not realize the operation is externally visible and live.
The article workflow publishes content with status="published" directly to a live site and then reports the public URL, but gives no prior warning that the content will be immediately visible to visitors and search engines. This can lead to accidental release of unreviewed AI-generated text, policy-violating claims, or sensitive business information on a production website.
All user-facing examples and responses in this file are in Chinese, and there is no indication that the skill offers a language choice or that it is intentionally restricted to a Chinese-speaking locale. Under SQP-3, forcing a specific language without user opt-in can constitute a natural-language policy violation.