Write My Blog

• Outcome: Review
• Latest audit: May 28, 2026 · 12:46 PM UTC
• Version: 0.1.0

Overview

This skill is a coherent blog publishing tool, but it gives agents high-impact publishing, deployment, and credential-handling power with weak safeguards.

Review this skill before installing. Use it only in a dedicated blog project, back up any existing .env.local first, upgrade the web framework, harden content sanitization and SVG handling, and require explicit approval before deleting posts, publishing, switching production themes, or deploying.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger keywords include very common terms such as `write`, `post`, `article`, and `deploy`, which can cause the skill to activate in unrelated conversations. In a skill with file-writing, command execution, and deployment guidance, overbroad activation increases the chance of unintended destructive or external actions being proposed or taken in the wrong context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation includes destructive and high-impact actions such as deleting posts, switching production themes, and deploying to Vercel or Cloudflare without requiring explicit user confirmation or warning about consequences. In an autonomous agent setting, omission of confirmation guidance can lead to accidental content loss, service changes, or unintended publication of data to public infrastructure.

Natural-Language Policy Violations

Medium

• Confidence: 99% confidence
• Finding: The lockfile explicitly records that the project is pinned to Next.js 14.2.21 and includes upstream metadata stating that this version has a known security vulnerability. Because this skill exposes blog creation, content management, and deployment functionality, a vulnerable web framework could directly affect server-side routes, rendering, middleware, or admin surfaces reachable by attackers.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: In non-interactive mode, the script will overwrite an existing .env.local automatically, replacing prior configuration and secrets without any safeguard. In an agent/CI context this is risky because automation may silently destroy working credentials, rotate service endpoints unexpectedly, or replace production-like settings with attacker-controlled values from environment variables or flags.

Credential Access

High

• Category: Privilege Escalation

Content

SKIP_ENV=false
  fi
elif [ -f "$ENV_FILE" ] && ! $INTERACTIVE; then
  echo "⚠️  .env.local already exists — overwriting (non-interactive mode)"
  SKIP_ENV=false
else
  SKIP_ENV=false

• Confidence: 93% confidence
• Finding: Automatically overwriting .env.local in non-interactive mode affects a file that commonly contains API keys, database credentials, and service tokens. While not exfiltration, it is a real security issue because it can clobber valid secrets, inject untrusted credentials from environment variables, and alter deployment behavior in agent-driven setups.

Credential Access

High

• Category: Privilege Escalation

Content

ask REDIS_URL "Redis URL" "redis://localhost:6379"
  fi

  # ── Write .env.local ──
  cat > "$ENV_FILE" <<EOF
# ── Write My Blog — Generated $(date +%Y-%m-%d) ──

• Confidence: 87% confidence
• Finding: The script writes secrets such as API_KEY and service credentials directly into .env.local without setting restrictive file permissions or using a safer secret-management mechanism. In environments where filesystem permissions are broad, secrets may be exposed to other local users, included in archives, or mishandled by follow-on automation.

Credential Access

High

• Category: Privilege Escalation

Content

sed -i "s|^SUPABASE_URL=.*|SUPABASE_URL=$SUPABASE_URL|" "$ENV_FILE"
          sed -i "s|^SUPABASE_SERVICE_KEY=.*|SUPABASE_SERVICE_KEY=$SUPABASE_KEY|" "$ENV_FILE"
        fi
        echo "✅ Switched to Supabase. .env.local updated."
        echo ""
        echo "🔨 Rebuilding..."
        cd "$PLATFORM_DIR"

• Confidence: 86% confidence
• Finding: Updating .env.local in place with sed inserts sensitive values such as Supabase credentials directly into a plaintext file, again without permission hardening or escaping of special characters. This can expose credentials locally and may corrupt the file if values contain sed-sensitive characters, leading to broken or unintended configuration.

Credential Access

High

• Category: Privilege Escalation

Content

sed -i "s|^MONGODB_URI=.*|MONGODB_URI=$MONGODB_URI|" "$ENV_FILE"
          sed -i "s|^MONGODB_DB_NAME=.*|MONGODB_DB_NAME=$MONGODB_DB_NAME|" "$ENV_FILE"
        fi
        echo "✅ Switched to MongoDB Atlas. .env.local updated."
        echo ""
        echo "🔨 Rebuilding..."
        cd "$PLATFORM_DIR"

• Confidence: 86% confidence
• Finding: This branch writes MongoDB credentials into .env.local using inline replacement, with the same plaintext storage and escaping risks as the Supabase path. In an autonomous blog deployment skill, database credentials are high-value because compromise enables content tampering, data access, and persistence in the deployed application.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.