Security audit

Strapi CMS

Security checks for vulnerabilities and agentic risk

Overview

This Strapi skill is coherent but gives an agent broad authenticated CMS, user, file, and raw API power with weak safeguards around secrets, file access, remote downloads, and destructive actions.

Install only for a Strapi instance you trust, with a narrowly scoped API token and HTTPS base URL. Avoid using it for account authentication, password reset, arbitrary local file paths, or URL-based media uploads until those paths are constrained and secrets are redacted. Confirm destructive content, schema, user, locale, and media operations manually before execution.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: src/client.ts:5
Finding: Authenticated Strapi Traffic Can Be Sent Over Cleartext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/handlers/files.ts:24
Finding: Unrestricted Remote File Download Enables Server-Side Request Forgery and Memory Exhaustion
Content: View full analysis
{ const response = await fetch(url); if (!response.ok) { throw new Error(`Failed to download file from ${url}: HTTP ${response.status} ${response.statusText}`); } const contentType = response.headers.get('content-type'); const fileName = extractFileName(url); const mimeType = contentType?.split(';')[0]?.trim() || getMimeType(fileName); const buffer = await response.arrayBuffer(); return { buffer, mimeType, fileName }; } ``` The URL is consumed directly during upload: ```ts if (isUrl(source)) { const downloaded = await fetchFileFromUrl(source); fileData = downloaded.buffer; fileName = downloaded.fileName; mimeType = downloaded.mimeType; } ``` ### Technical Analysis The file-upload feature accepts any `http://` or `https://` URL and fetches it from the Agent host. It does not restrict destination hosts or resolved IP addresses and does not block: - Loopback services. - RFC 1918 private networks. - Link-local addresses. - Cloud instance metadata endpoints. - Internal DNS names. - Redirects to restricted destinations. - DNS rebinding to a private address. This creates an SSRF primitive from the Agent’s network position. Although the response is not printed directly, its contents are packaged into a file and uploaded to Strapi, providing a potential exfiltration path fo ...[truncated 1545 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/handlers/files.ts:82
Finding: Unrestricted Local File Paths Can Be Read and Uploaded to Strapi
Content: View full analysis
; formData.append('fileInfo', JSON.stringify(fileInfo)); } if (args[2]) { const linkInfo = JSON.parse(args[2]) as Record; if (linkInfo.ref) formData.append('ref', linkInfo.ref); if (linkInfo.refId) formData.append('refId', linkInfo.refId); if (linkInfo.field) formData.append('field', linkInfo.field); } return fetchJson(client, '/upload', { method: 'POST', body: formData as unknown as RequestInit['body'], }); ``` ### Technical Analysis The upload command treats every non-HTTP input as a filesystem path and reads it with `readFileSync()`. There is no restriction to a workspace, media directory, or user-approved root. The code also lacks: - Canonical-path containment checks. - Symlink protection. - Verification that the target is a regular file. - File-size limits. - Sensitive-path deny rules. - Mandatory confirmation of the resolved path. - Validation that the file type is appropriate for media upload. The file contents are then sent through an authenticated request to the configured ...[truncated 1310 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: instructions.md:343
Finding: Passwords and Reset Tokens Are Exposed Through Process Arguments and Login JWTs Are Printed to Standard Output
Content: View full analysis
\n' + 'Example: \'{"identifier":"user@example.com","password":"password123"}\'\n' + 'identifier can be email or username' ); } return fetchJson(client, '/auth/local', { method: 'POST', body: raw, headers: { 'Content-Type': 'application/json' }, }); } ``` All successful results are printed without redaction: ```ts console.log(JSON.stringify(result, null, 2)); ``` ### Technical Analysis Passwords and reset codes are passed as JSON in `process.argv`. Depending on the host and execution environment, command-line arguments may be visible through process inspection, shell history, Agent tool logs, audit telemetry, crash reports, or conversation transcripts. The login endpoint returns a JWT and user data. The CLI serializes the complete response to stdout, with no redaction ...[truncated 1401 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (197)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill description claims broad CMS, media, schema, locale, auth, and raw HTTP management capabilities that the underlying implementation reportedly does not actually provide. This mismatch is dangerous because users and orchestrators may invoke the skill under false assumptions, potentially exposing credentials, routing sensitive requests to the wrong capability set, or approving a skill whose real behavior has not been accurately represented.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The end-user management examples include listing users, creating accounts with plaintext credentials in examples, assigning roles, and blocking users without emphasizing sensitivity or confirmation requirements. In a skill designed for agent-driven execution, this can lead to unauthorized account creation, privilege misuse, exposure of credentials in logs/history, and harmful user-management actions triggered by simple prompts.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 12)May include surrounding context.
md
- **Content introspection** — discover types, schemas, components, relations; inspect real data shape - **Schema management** — create/update/delete content types, components, fields (local/dev only; production blocks this) - **Form layout** — configure edit form field order, sizes, labels, descriptions (local/dev only) - **Draft & publish** — list drafts/published, publish, unpublish, create as draft or published - **Media library** — list, get, upload, update metadata, delete files - **Users & Permissions** — end-user CRUD, roles, authentication (login, register, password reset) - **Locales (i18n)** — list, create, delete locales

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README documents destructive collection, single-type, and media deletion commands in a high-impact CMS context without a clear general warning that these operations can permanently delete content or files. In an agent skill, terse examples can normalize irreversible actions and increase the chance of accidental data loss when invoked against production systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README exposes user-management and authentication commands, including create/update/delete users and login/register/password reset flows, without warning about credential handling, least privilege, audit sensitivity, or account-impacting consequences. In a skill that can act on live identity data, lack of guidance increases the risk of credential leakage, unauthorized account changes, and unsafe operation by downstream agents or users.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill advertises operations that inherently require network access and use of sensitive environment-backed credentials, but it does not declare an explicit tool scope such as allowed tools or permissions. This creates ambiguity in what the skill is authorized to do and weakens reviewability, increasing the chance of over-privileged or unintended execution against a live Strapi instance.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation description is very broad, covering generic CMS, media, REST API, user, role, and authentication requests. In an agent setting, this can cause the skill to trigger for loosely related prompts and perform credential-backed actions on a Strapi instance when the user may only be asking general questions, increasing the risk of unintended access or modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The setup instructs users to provide a Strapi API token and base URL, yet the skill description does not clearly warn that the skill can perform authenticated, integrity-impacting operations against a remote service and may expose sensitive data via raw HTTP access. With credential-backed network access to a CMS, insufficient privacy and integrity warnings materially increase the chance of accidental misuse or overtrust.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The capabilities list includes destructive operations such as schema create/update/delete and content deletion, but the description does not clearly warn that these actions can irreversibly alter production CMS data and structure. In this context, a Strapi admin skill connected to a live instance makes omission of such warnings more dangerous because a user may enable or invoke it without appreciating the blast radius.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.