Write My Blog

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:13 PM UTC
• Version: 0.1.0

Overview

This is a real blog platform skill, but it has several concrete security risks that users should review before installing or deploying it.

Install only if you are prepared to patch it before exposing it publicly: narrow activation triggers, upgrade Next.js and affected dependencies, replace the HTML/Markdown rendering and sanitization path with a maintained sanitizer, remove eval from setup.sh, avoid unpinned npx deployment tools, do not print API keys to logs, and use scoped deployment/API credentials.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (7)

T09 · Insecure Skill Coding Practices

Error

• Location: platform/src/app/post/[slug]/page.tsx:5

Finding

Stored Cross-Site Scripting Through Incomplete Content Sanitization

Content

View full analysis

)<[^<]*)*<\/script>/gi, "") .replace(/on\w+\s*=\s*"[^"]*"/gi, "") .replace(/on\w+\s*=\s*'[^']*'/gi, "") .replace(/javascript\s*:/gi, "") .replace(/data\s*:\s*text\/html/gi, ""); } ``` ```tsx // platform/src/app/post/[slug]/page.tsx async function renderMarkdown(md: string): Promise { let html = md .replace(/^### (.+)$/gm, "

$1

") .replace(/^## (.+)$/gm, "

$1

") .replace(/^# (.+)$/gm, "

$1

") .replace(/\*\*(.+?)\*\*/g, "$1") .replace(/\*(.+?)\*/g, "$1") .replace(/`(.+?)`/g, "$1") .replace(/^\- (.+)$/gm, "

$1

") .replace(/^\* (.+)$/gm, "

$1

") .replace(/(

.*<\/li>\n?)+/g, (m) => `

${m}

`) .replace(/^(?!<[hulo])((?!<).+)$/gm, "

$1

") .replace(/

<\/p>/g, ""); return html; } // ...

``` ### Technical Analysis The application claims to sanitize all content before storage, but its sanitizer is implemented with regular expressions. It only removes event-handler attributes when their values are enclosed in single or double quotes. Unquoted handlers, malformed HTML, namespace-based payloads, and many browser parser edge cases remain possible. For example, the following HTML is not removed: ```html ``` The custom Markdown renderer also preserves raw ...[truncated 1719 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: platform/src/lib/db/sqlite.ts:228

Finding

SQL Injection Through Unvalidated sortOrder Parameter

Content

View full analysis

= { createdAt: "created_at", updatedAt: "updated_at", title: "title", viewCount: "view_count", }; const orderColumn = columnMap[sortBy] || "created_at"; const rows = db .prepare( `SELECT * FROM posts ${whereClause} ORDER BY ${orderColumn} ${sortOrder} LIMIT ? OFFSET ?`, ) .all(...params, limit, offset) as any[]; ``` ### Technical Analysis The TypeScript cast does not perform runtime validation. Any string supplied in the `sortOrder` query parameter reaches the SQLite query and is interpolated directly after the `ORDER BY` column. Although `sortBy` is mapped through a fixed column allowlist, `sortOrder` is not normalized to `ASC` or `DESC`. SQL placeholders cannot normally be used for keywords, so an explicit runtime allowlist is required. The SQLite driver generally prevents stacked statements in a single prepared statement, but an attacker can still modify the syntax of the existing statement, introduce expressions or subqueries, trigger controlled errors, or conduct inference through result ordering and response behavior. ### Attack Path 1. An attacker obtains a valid API key. 2. The attacker calls the listing endpoint with a crafted `sortOrder` value. 3. The route only a ...[truncated 967 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:88

Finding

Shell Command Injection in Interactive Setup Input Handling

Content

View full analysis

local var_name="$1" prompt="$2" default="${3:-}" if $INTERACTIVE; then local current="${!var_name:-$default}" read -rp "$prompt [$current]: " input eval "$var_name=\"${input:-$current}\"" else if [ -z "${!var_name:-}" ]; then eval "$var_name=\"$default\"" fi fi } ask_secret() { # ask_secret local var_name="$1" prompt="$2" if $INTERACTIVE; then read -rsp "$prompt: " input echo "" eval "$var_name=\"$input\"" fi } ``` ### Technical Analysis The setup script constructs shell source code containing user-controlled or environment-controlled values and executes it with `eval`. A value containing quotation marks and shell syntax can terminate the intended assignment and append arbitrary commands. The affected helper is used for blog names, descriptions, themes, database URLs, database names, service credentials, and Redis URLs. Environment-derived defaults also pass through `eval` when the user accepts a default. The `eval` operation is unnecessary. Bash supports safe indirect assignment through `printf -v`, which does not reparse the value as shell code. ### Attack Path 1. A user or agent runs the documented setup command: ```bash bash ../scripts/setup.sh ``` 2. An attacker causes the operator to paste a crafted configuration value, or controls a `SETUP_*` environment variable used as the accepted default. 3. A value such as the following is entered into a field handled by `ask()`: ```text x"; touch /tmp/setup-command-executed; # ``` 4. The generated `eval` input becomes equivalent to: ```bash BLOG_NAME="x"; touch /tmp/setup-command-executed; #" ``` 5. The injected command executes with the permissions of the user r ...[truncated 470 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup.sh:455

Finding

Unpinned npx Packages Enable Mutable Remote Code Execution During Setup

Content

View full analysis

/dev/null; then echo "📦 Installing Vercel CLI..." npm install -g vercel fi echo " Vercel CLI: $(npx -y vercel --version 2>/dev/null)" ``` ```bash # Wrangler CLI if ! npx -y wrangler --version &>/dev/null; then echo "📦 Installing Wrangler CLI..." npm install -g wrangler fi echo " Wrangler CLI: $(npx -y wrangler --version 2>/dev/null)" ``` ```bash if npx -y @cloudflare/next-on-pages 2>&1; then if npx -y wrangler pages deploy \ .vercel/output/static --project-name "$CF_PROJECT" \ --commit-dirty=true 2>&1; then echo "✅ Deployed to Cloudflare Pages" fi fi ``` ### Technical Analysis `npx -y ` downloads and executes a package when it is not locally installed. No package versions are specified for `vercel`, `wrangler`, or `@cloudflare/next-on-pages`, and these tools are not pinned in the project lockfile. Consequently, the code reviewed during this audit is not necessarily the code that will execute later. A compromised publisher account, registry compromise, malicious future release, or dependency-chain compromise could cause arbitrary code to run during setup or deployment. The deployment functionality legitimately requires network access, but retrieving mutable executable code at runtime is broader than the minimum privilege needed. Deployment tools should be reviewed and pinned before execution. ### Attack Path 1. A user selects Vercel or Cloudflare deployment, or non-interactive setup specifies a deployment target. 2. `npx -y` resolves the current registry version at execution time. 3. npm downloads the package and its transitive dependencies. 4. Package lifecycle scripts and the package executable run under the invoking user. 5. If the resolved pa ...[truncated 734 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: platform/package-lock.json:1680

Finding

Application Uses a Dependency Explicitly Marked as Security-Vulnerable

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:665

Finding

Generated API Key Is Printed in Full to Non-Interactive Setup Logs

Content

View full analysis

Remediation

View remediation

"$ENV_FILE" chmod 600 "$ENV_FILE" ``` 6. Rotate any API keys that have already appeared in setup, CI, or agent logs. 7. Escape JSON through a real JSON serializer rather than string interpolation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: platform/src/lib/auth/middleware.ts:14

Finding

Rate Limiting Can Be Bypassed and Used for Memory Exhaustion Through Spoofed Forwarding Headers

Content

View full analysis

(); function checkRateLimit(ip: string): boolean { const now = Date.now(); let bucket = rateBuckets.get(ip); if (!bucket) { bucket = { tokens: RATE_LIMIT, lastRefill: now }; rateBuckets.set(ip, bucket); } // ... } ``` ```ts export async function validateRequest( request: NextRequest, ): Promise { const ip = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || request.headers.get("x-real-ip") || "unknown"; if (!checkRateLimit(ip)) { return NextResponse.json( { error: "Rate limit exceeded. Try again later." }, { status: 429, headers: { "Retry-After": "60" }, }, ); } // API key validation follows } ``` ### Technical Analysis The limiter trusts the leftmost value of `X-Forwarded-For`. Unless the hosting environment removes client-supplied forwarding headers and reconstructs them from trusted proxy data, an attacker can select a new bucket by changing that header. The `Map` is unbounded and entries are never removed. Because rate limiting occurs before authentication, an unauthenticated attacker can send requests with unique spoofed addresses and continuously allocate new entries. The limiter is also process-local, so serverless instances and horizontally scaled processes do not share limits. ### Attack Path 1. An unauthenticated attacker repeatedly calls any protected API endpoint. 2. Each request uses a different header: ```http X-Forwarded-For: 198.51.100.1 X-Forwarded-For: 198.51.100.2 X-Forwarded- ...[truncated 638 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (123)

Known Vulnerable Dependency: next==14.2.21 — 16 advisory(ies): GHSA-2xp9-vwfh-vxw4 (Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AV); CVE-2026-44573 (Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n); CVE-2026-44572 (Next.js's Middleware / Proxy redirects can be cache-poisoned) +13 more

Critical

• Category: Supply Chain
• Confidence: 99% confidence

Finding

next 14.2.21 is explicitly marked deprecated for a security vulnerability in the lockfile, and the cited advisories include severe issues such as unauthenticated RCE and middleware/cache bypasses. Because this skill exposes a full-featured autonomous blog platform with publishing, uploads, and deployment features, a framework-level compromise could lead to complete application takeover, content tampering, or infrastructure abuse.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a comprehensive blogging system with multiple operational capabilities, but the provided code chunk is merely boilerplate TypeScript configuration for Next.js (next-env.d.ts). This file only supplies type references and does not implement or evidence any of the advertised features. Therefore, the description does not accurately represent the behavior of the supplied code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises autonomous blog creation, content publishing, media upload, theme switching, and deployment features. The supplied code does none of those things. Instead, it exposes a secured analytics-read endpoint whose primary function is to fetch analytics from a database and return them in an HTTP response. This is a materially different purpose from the declared blog-management and publishing capabilities, so the description does not accurately represent the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a comprehensive autonomous blog platform with writing, publishing, media management, theme selection, deployment, and broad infrastructure support. The supplied code chunk is much narrower: it is a single-post API endpoint that retrieves, updates, and deletes posts by slug, plus caching and security middleware. While this is related to blog content management, it does not substantiate most of the advertised capabilities, and its actual primary purpose is CRUD-style API handling for individual posts rather than full autonomous blog creation/deployment. Therefore the description materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code is clearly related to blog post management, so it partially aligns with the blog/content-management theme. However, the declared description is much broader and claims major capabilities not present in this code chunk: autonomous writing, media upload, theme management, deployment, and explicit support for many storage/cache backends. The actual code only provides authenticated CRUD-adjacent behavior for posts, specifically creating and listing posts with caching and validation. This is a material overstatement of functionality, so the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a broad blog-management and deployment capability set. The supplied code does not implement those features; it only exposes authenticated endpoints for fetching and updating settings, with sanitization and cache invalidation. While settings management could be a supporting part of a blog platform, this chunk’s primary behavior is materially narrower and different from the declared purpose. Therefore, the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code is narrowly focused on theme management. GET returns the active theme and a fixed list of 10 themes; PUT validates a requested theme, updates activeTheme in settings, and clears a settings cache key. While this partially aligns with the description's claim about switching between 10 themes, the declared purpose describes a much broader blogging and deployment system. For this code chunk, the actual primary purpose is theme listing/switching, not autonomous blog creation, publishing, media handling, or deployment. This is a material description-versus-behavior mismatch, even though some broader claims may be true elsewhere in the overall skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a full autonomous blogging and deployment capability, but the supplied code chunk is purely a security/authentication middleware module. Its primary purpose is to validate API keys, enforce per-IP rate limits, sanitize input, and attach security headers. These behaviors are materially different from the described blogging platform features, and the actual implemented capabilities are largely unrelated to the declared triggers and purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a strong mismatch between the description and the supplied code. The declared purpose presents a comprehensive blogging and deployment capability, but the actual code chunk contains only an abstract cache interface definition. While caching could be a supporting detail in a larger blogging system, this snippet does not implement any blog-related functionality, deployment logic, theme management, media handling, or database support. Its primary purpose is cache abstraction, which is materially different from the declared end-user functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code is a narrow infrastructure utility for selecting a cache adapter. It does not contain blog management, content writing, publishing, deployment, theming, media handling, or database integration logic. While caching is mentioned in the description, the implementation only supports memory and Redis, not the broader claimed platform functionality or other listed cache/database backends. This is a material mismatch in primary purpose and represented capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a broad blogging platform with content creation, publishing, deployment, theming, and multiple storage backends. The actual code chunk is a narrow infrastructure component: an in-memory cache adapter. While in-memory caching is mentioned in the description, this code alone does not implement the primary blog-related capabilities or the broader deployment/database features. Therefore the code’s actual behavior is materially narrower and different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This code does not implement the declared primary purpose of an autonomous blog platform. Its behavior is narrowly focused on cache storage and invalidation using Redis-compatible backends. While caching is mentioned in the broader description as a supported backend, this chunk lacks the core blogging, publishing, theming, media, deployment, and database management capabilities the description emphasizes. Therefore the description does not accurately represent what this supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The code is clearly related to blogging, so the general domain matches part of the description: it supports creating, updating, listing, deleting, and publishing posts, saving media, storing settings, and gathering simple analytics. However, the declared description claims a much broader capability set than this code chunk actually provides. This chunk is specifically a SQLite adapter plus local file media storage and auth/session management. It does not implement theme switching, deployment, or the multiple named database/cache backends. Additionally, it includes auth and API key capabilities not declared in the description. Because the actual code only partially matches the declared purpose and also contains undeclared auth-related behavior, this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description advertises a broad autonomous blogging system with content authoring, publishing, theming, media handling, deployment, and multi-backend support. The actual code chunk only performs database migration setup and execution by loading .env.local variables and calling db.migrate(). This is a materially narrower and different behavior than the declared purpose. While migrations could be a supporting implementation detail within a blog platform, this specific chunk does not implement or demonstrate the declared end-user capabilities, and its primary observable behavior is schema migration.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger keywords are extremely broad ('write', 'publish', 'post', 'article', 'deploy') and are likely to match ordinary user requests outside the intended context. In an agent environment, that can cause accidental activation of a powerful skill that can write files, run commands, modify content, and perform deployment-related actions, increasing the risk of unintended side effects.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==3.14.2 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

js-yaml 3.14.2 is a known vulnerable version, and here it is pulled in via gray-matter, which is commonly used to parse front matter in Markdown blog posts. In a blog authoring system that may process untrusted or AI-generated content, parser-level CPU exhaustion can enable denial-of-service during content ingestion or build/render workflows.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

nanoid 3.3.11 has reported issues involving edge-case generator misuse such as zero or negative sizes and overflow behavior. In this lockfile it is a transitive dependency of postcss rather than an obviously exposed security boundary, so the practical exploitability in this skill is limited but still represents a vulnerable package version.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.4.31 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

postcss 8.4.31 has advisories including arbitrary file read and XSS-related issues. In a themable blog platform that may compile or transform CSS for premium themes, attacker-influenced styling inputs or build artifacts could turn these weaknesses into information disclosure or client-side injection.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==7.22.0 — 16 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +13 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

undici 7.22.0 has multiple network-protocol advisories including request/response smuggling and CRLF injection. This matters in a platform that integrates with external services like Cloudflare, Vercel, databases, or remote media endpoints, because malformed outbound or proxied HTTP interactions can become a pivot for cache poisoning, request confusion, or data exposure.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

ws 8.19.0 includes advisories for memory disclosure and memory exhaustion DoS. In this package set it is brought in by optional realtime/networking dependencies, so if websocket features are enabled for deployment, previews, or backend integrations, an attacker may be able to crash services or leak process memory under certain conditions.

Content

No source excerpt is available for this finding.

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 99% confidence

Finding

This is the same core issue as SQP-2: untrusted post content reaches dangerouslySetInnerHTML after only superficial markdown-like replacement. In a blogging skill, content creation and publishing are central features, which increases danger because stored malicious content is likely to be rendered to many visitors and can lead to session theft, account takeover, admin compromise, or malicious actions in readers' browsers.

Content

Scanner excerpt · platform/src/app/post/[slug]/page.tsx (reported line 57)May include surrounding context.

tsx

</div>
                )}

                <div className="post-body" dangerouslySetInnerHTML={{ __html: html }} />
            </article>

            <footer className="blog-footer">

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 63)May include surrounding context.

Delete Post

http

DELETE /api/posts/{slug}

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 179)May include surrounding context.

sh

# ═══════════════════════════════════════
# 3. Configure environment
# ═══════════════════════════════════════
ENV_FILE="$PLATFORM_DIR/.env.local"

if [ -f "$ENV_FILE" ] && $INTERACTIVE; then
  echo "⚠️  .env.local already exists."

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 185)May include surrounding context.

sh

# ═══════════════════════════════════════
# 3. Configure environment
# ═══════════════════════════════════════
ENV_FILE="$PLATFORM_DIR/.env.local"

if [ -f "$ENV_FILE" ] && $INTERACTIVE; then
  echo "⚠️  .env.local already exists."

Static analysis

No suspicious patterns detected.