ClawHub
Back to skill

Security audit

ghost-publishing-pro

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Ghost publishing assistant, but it under-discloses several high-impact actions such as browser-based code injection guidance, broad destructive API references, third-party calls, cron automation, and mass newsletter sends.

Install only if you are comfortable granting an agent the ability to publish, edit, schedule, and potentially email content from your Ghost site. Use a dedicated revocable Ghost integration key where possible, avoid owner-level tokens unless a specific task requires them, do not let the agent run browser code-injection steps autonomously, and require explicit confirmation before deletes, bulk writes, cron/webhook automation, or newsletter sends.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (22)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md
r, and full Squarespace/WordPress/Substack migrations. All 18 workflows are in `references/workflows.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

md
r, and full Squarespace/WordPress/Substack migrations. All 18 workflows are in `references/workflows.md`.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
84% confidence
Finding

Exposing a raw DELETE /posts/{id}/ capability without guardrails creates a tool-parameter abuse risk: an agent or attacker controlling prompts could supply arbitrary post IDs and remove content. Because this skill is designed for automation against production Ghost Admin APIs, the context makes destructive misuse more dangerous than in passive documentation alone.

Content

Scanner excerpt · references/api.md (reported line 113)May include surrounding context.

md
Filter options: `status:draft`, `status:published`, `tag:name`

### Delete post
`DELETE /posts/{id}/`

---

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/workflows.md (reported line 1167)May include surrounding context.

Quick check: fetch post by slug from Ghost API

TOKEN=... # generate JWT SLUG="your-post-slug" curl -s "{url}/ghost/api/admin/posts/slug/${SLUG}/?fields=id,title,slug,status"
-H "Authorization: Ghost ${TOKEN}" | python3 -c "import json,sys; p=json.load(sys.stdin)['posts'][0]; print(p['status'], p['title'])"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
required: true
binaries:
  - node
  - curl
  - python3
license: MIT
metadata: ~

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill asserts that no external calls occur outside the Ghost instance, but later instructs users to fetch YouTube oEmbed data from youtube.com. This is a real security/integrity issue because operators may rely on the stated trust boundary when deciding whether the skill is safe for restricted environments, and the undocumented third-party call can leak usage metadata or violate network policy.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md
</gate>

  <gate id="settings_wall" priority="5" severity="soft" scope="pre_settings">
    <condition>About to write to Ghost site settings, code injection, redirects, or staff</condition>
    <question>Does the task require owner-level access that integration tokens cannot provide?</question>
    <pass_action>Stop. This operation is a Ghost platform limitation — outside the scope of this skill. Flag it to the user: this endpoint returns 403 for integration tokens by design and cannot be automated via the Admin API.</pass_action>
    <fail_action>Do not attempt. Do not suggest browser fallback. State the platform limitation clearly and stop.</fail_action>

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The documented capability scope says operations are limited to posts, analytics, images, scheduling, and newsletters, but the file also advertises theme management. That mismatch weakens least-privilege review because theme upload/activation can alter site-rendered code and carries broader security consequences than ordinary content publishing.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

This is the same trust-boundary inconsistency expressed elsewhere: the document claims no external calls outside the Ghost instance while instructing a call to YouTube's oEmbed endpoint. Misrepresenting egress behavior is dangerous because defenders may approve the skill under false assumptions about data flow and network exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 330)May include surrounding context.

Create a tag

python
r = requests.post(
    f'{GHOST_URL}/ghost/api/admin/tags/',
    headers=headers,
    json={"tags": [{"name": "Your Tag", "slug": "your-tag"}]}

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 346)May include surrounding context.

python
# Fetch tag id first via list, then:
r = requests.put(
    f'{GHOST_URL}/ghost/api/admin/tags/{TAG_ID}/',
    headers=headers,
    json={"tags": [{"id": TAG_ID, "name": "Updated Name", "slug": "updated-slug"}]}

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 381)May include surrounding context.

md
existing_tags = [{"id": t["id"]} for t in post.get("tags", [])]
    if not any(t["id"] == TAG_ID for t in existing_tags):
        existing_tags.append({"id": TAG_ID})
        requests.put(
            f'{GHOST_URL}/ghost/api/admin/posts/{post["id"]}/',
            headers=headers,
            json={"posts": [{"id": post["id"], "updated_at": post["updated_at"], "tags": existing_tags}]}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation normalizes a single API call that both publishes content and emails all subscribers, but does not prominently warn about the blast radius or require confirmation. In an automation context, this increases the chance of accidental mass mail, reputational damage, spam complaints, and unintended subscriber outreach from a mistaken or malicious prompt.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The delete-post endpoint is documented as a simple operation without any warning that it is destructive and may be irreversible in an automated workflow. In a tool-using agent context, that omission raises the risk of accidental deletion, prompt-induced misuse, or unauthorized content removal affecting site integrity and business operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill is explicitly described as Admin-API-only, yet this section provides browser-based code injection instructions for modifying site-wide JavaScript. That expands the operational scope from API publishing into persistent client-side code modification, which can be abused for defacement, tracking injection, phishing content, or malicious script persistence across all visitors.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Although the text says the step is owner-only and manual, it still gives exact autonomous execution primitives for reading and overwriting the CodeMirror editor contents. In practice, those instructions are sufficient for an agent to perform a sensitive dashboard action, undermining the stated safety boundary and enabling unauthorized or insufficiently reviewed site-wide script changes.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/workflows.md (reported line 94)May include surrounding context.

bash
# 1. Upload image
curl -X POST "{url}/ghost/api/admin/images/upload/" \
  -H "Authorization: Ghost {token}" \
  -F "file=@/path/to/image.jpg" \
  -F "purpose=image"

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/workflows.md (reported line 452)May include surrounding context.

md
**Make — cross-post to LinkedIn:**
- Trigger: Webhooks module (post.published)
- Action: HTTP module → LinkedIn API → create post with excerpt + link

**OpenClaw cron as webhook receiver:**
You can point Ghost webhooks at your OpenClaw gateway (if externally accessible) to trigger agent actions directly on publish events.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file gives step-by-step instructions for sending a newsletter to all members by reverting and republishing an already-published post, which can affect user data and trigger irreversible outbound email. Although a precondition notes approval and irreversibility, the workflow is presented as a normal operational pattern without a stronger top-level caution banner or explicit warning summary for accidental misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The example HTML hard-codes lang="en", which imposes a specific language/locale choice in the skill guidance. The file does not present this as optional or limited to English-only sites, so it can conflict with the policy against forcing a locale without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The skill repeatedly frames itself as Admin-API-only and says unsupported endpoints should simply be treated as platform limitations, yet this pitfall guidance suggests a different acquisition path via page HTML (data-key=) for a Content API key. That advice contradicts the stated 'Admin API only' positioning and expands operational guidance beyond the declared interface. The contradiction is documented in the text itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document's book-style HTML examples and rules instruct wrapping content in lang="en" / English language settings for hyphenation, which effectively forces a specific locale in the generated content. There is no user choice or opt-in, and the guidance is framed as a general pattern rather than a clearly region- or language-specific workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.