Security audit

ghost-publishing-pro

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a Ghost publishing helper, but its docs expand beyond the stated Admin API-only scope into browser code injection, external webhook/data sharing, persistent automation, and broader credentials.

Review this skill carefully before installing. Use a dedicated, revocable Ghost integration key where possible, avoid owner tokens unless a specific task requires them, do not allow autonomous browser code injection or settings changes, require explicit confirmation before publishing or emailing subscribers, and do not enable webhooks or cron publishing until you have scoped events, payloads, authentication, and rollback procedures.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill states that operations are confined to the Ghost instance, but its documented workflows include Google Search Console indexing repair and external YouTube embeds. This kind of scope misrepresentation can cause operators to approve or run the skill under a false assumption about where data or requests may go, which weakens informed consent and security review.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The documentation explicitly claims that no external calls occur outside the Ghost instance, yet later sections describe workflows involving external services and external URLs. This contradiction undermines trust boundaries and can lead users to expose content, metadata, or credentials-adjacent operations to third parties they did not expect.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: Earlier sections imply that a dedicated integration token provides the full supported publishing workflow with only a few platform-limited exceptions, but the tag-management section later states that tag write operations require stronger admin/owner credentials. This mismatch can push users toward unnecessarily broad credentials and makes privilege requirements unclear, increasing the chance of over-privileged token use.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The reference materially expands an 'Admin API only' skill into browser-based code-injection workflows that modify site-wide JavaScript. Even though it labels the step as manual and owner-only, including executable guidance for code injection creates a clear path to alter visitor-facing behavior outside the declared scope, increasing the chance of misuse or unsafe automation. In a publishing skill, site-wide script injection can enable phishing, tracking, content manipulation, or supply-chain style abuse affecting all site visitors.

Intent-Code Divergence

Low

Confidence: 87% confidence
Finding: The document states certain operations are browser-only and blocked to integration tokens, yet still supplies a concrete browser procedure for performing code injection in an API-focused reference. This contradiction weakens scope boundaries and may encourage an agent or operator to bypass intended permission limits using manual browser automation patterns. In context, that makes the skill more dangerous because the stated 'Admin API only' constraint is no longer reliable.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The webhook automation guidance expands the skill from Ghost publishing into cross-platform actions and external data sharing, including sending subscriber events and emails into Slack/Zapier/Make/n8n or an externally accessible gateway. This increases the attack surface and can leak personal data or trigger unintended downstream actions outside the user's Ghost environment.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation exposes a destructive delete endpoint without any safety guidance such as confirmation, dry-run, recycle/backup considerations, or ownership checks. In an automation-oriented publishing skill, that omission increases the risk of accidental or over-broad content deletion, especially if an agent is asked to operate on ambiguous identifiers or bulk lists.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow explicitly recommends publishing and sending to `email_segment: "all"` in one API action, but does not present a strong warning that this is effectively irreversible and can blast all subscribers immediately. In an agentic context, that can cause mass unintended email sends, reputational damage, and possible compliance issues if triggered with wrong or unreviewed content.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The cron-based automation pattern enables unattended publication from a drafts queue, including possible newsletter delivery, without a strong user-facing safeguard. In an autonomous workflow, mistakes in scheduling, content selection, or prompt interpretation could result in accidental live publishing or subscriber email sends without human review.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The webhook examples send subscriber events, including member email information, to external services like Slack and Zapier without a privacy or data-handling warning. That can expose personally identifiable information to third parties, expand data retention footprints, and create compliance risk under privacy regimes or internal policy.

Session Persistence

Medium

Category: Rogue Agent
Content: **Make — cross-post to LinkedIn:** - Trigger: Webhooks module (post.published) - Action: HTTP module → LinkedIn API → create post with excerpt + link **OpenClaw cron as webhook receiver:** You can point Ghost webhooks at your OpenClaw gateway (if externally accessible) to trigger agent actions directly on publish events.
Confidence: 70% confidence
Finding: Pointing Ghost webhooks at an externally accessible OpenClaw gateway can create a persistent event-driven control path into the agent environment. Without strong authentication, validation, replay protection, and scope restriction, external events could trigger unintended agent actions or maintain an ongoing automation channel beyond the immediate user session.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.