Security audit

Feima Lab Content Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly transparent about managing Feima Lab content, but it can upload local files and modify live remote articles with broad triggers and limited confirmation safeguards.

Install only if you intend to let this skill manage Feima Lab content and use an internal API key. Before publishing, uploading, or unpublishing, confirm the exact article, target backend, and file paths; avoid running it on untrusted markdown with local file references; and do not provide broad filesystem paths or secrets as image/file inputs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: This library is explicitly designed to contact a remote backend and is configured with a production API base URL by default. That behavior materially exceeds a purely local content-formatting/editor role, so users may expose document contents and metadata to an external service without expecting network egress.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Reading an API key from the environment is a normal implementation pattern, but in this skill it indicates authenticated access to an undisclosed external service. When the manifest presents the skill as a local content-conversion tool, hidden credential use increases the risk of unexpected data exfiltration or privileged backend actions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The multipart upload function reads arbitrary local files from disk and sends them to a remote API. In the context of a skill described as document conversion/styling, that is a significant capability mismatch and can leak sensitive local content if invoked on unintended paths or without clear user awareness.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script resolves any non-URL image reference either as an absolute path or relative to the MDX file, then copies it into the post's images directory. If untrusted markdown is processed, an attacker can reference arbitrary readable local files such as /etc/passwd or project secrets, causing unintended local file exfiltration into published content or repository assets.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The remote-publish trigger examples are broad natural-language phrases like '推到远程' and '把这篇发布到 feima-lab', which could be matched during ordinary conversation and cause an agent to initiate networked publishing unexpectedly. In a skill that performs live CRUD, upload, and publish actions against a backend, ambiguous invocation increases the risk of unintended external side effects.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README advertises remote article CRUD, image upload to OSS, and automatic cover upload, but does not prominently warn that content and files will be transmitted to external services. Users may reasonably assume the tool remains local because the document strongly emphasizes local build and zero-dependency preview, making silent transition to networked operations more risky.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger list contains broad phrases like blog 写作, 保存文章, 更新文章, 上传封面图, and 列出文章 that are not tightly scoped to the feima-lab domain. In an agent environment, this can cause the skill to activate for unrelated content-management requests, leading to unintended file changes or remote CMS actions under the wrong context.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill advertises save, update, publish, and unpublish capabilities against a remote backend, but the top-level description does not clearly warn that these actions modify live remote content. Because the skill also supports one-click publishing and automatic tag/category/image handling, accidental invocation or misunderstood user intent could result in unauthorized or unintended publication changes.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The workflow explicitly instructs the agent to write multiple files, localize images, and run scripts that may download or store external content, but it does not require user confirmation, path restrictions, or safety checks before modifying the workspace. In an agent setting, this can lead to unintended file changes, persistence of external content, or writing into sensitive directories if the post directory or image sources are not tightly controlled.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This code uploads local file contents over the network without any user-facing warning or consent mechanism in the implementation. Silent transmission of local files is dangerous because users may assume files are processed locally, leading to accidental disclosure of proprietary or sensitive data.

Ssd 3

Medium

Confidence: 89% confidence
Finding: The skill instructs the agent to write user-provided profile defaults such as author name, default category, tags, and slug style into MEMORY.md, creating persistent retention of personal or preference data in natural-language storage. This increases privacy and data-minimization risk, especially if the repository is shared, synced, or later reused in unrelated sessions without the user's awareness.

Static analysis

Detected: suspicious.env_credential_access, suspicious.obfuscated_code

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/api/_lib.mjs:29

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: scripts/render.mjs:15334