ClawHub
Back to skill

Security audit

Ghost CMS Agent

Security checks for vulnerabilities and agentic risk

Overview

This Ghost CMS skill is purpose-aligned overall, but it handles powerful Admin API credentials unsafely and can publish or modify live content with limited safeguards.

Review this skill carefully before installing. Only use it with a test Ghost site or a tightly scoped integration key, verify GHOST_URL is the exact HTTPS admin endpoint you trust, and rotate any Admin API key already used with these scripts because the current implementation sends the raw secret portion as an authorization credential.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/new-post.sh:65
Finding

Long-Lived Ghost Admin API Secret Transmitted as an Authorization Credential

Content
View full analysis
Remediation
View remediation
` header. 4. Never transmit, print, log, or return the signing secret. 5. Redact authorization headers in reverse-proxy, application, and diagnostic logs. 6. Rotate any Admin API key that has already been used by the current implementation. 7. Add automated tests confirming that the raw key and its secret portion never appear in outbound requests. 8. Prefer protected environment or secret-manager injection. Remove the `--api-key` command-line option because command-line values can be retained in shell history or exposed through process inspection. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/new-post.sh:43
Finding

Credential-Bearing Requests Permit Arbitrary and Non-HTTPS Ghost URLs

Content
View full analysis
&2 exit 1 fi if [[ -z "$ADMIN_API_KEY" ]]; then echo "Error: --api-key or GHOST_ADMIN_API_KEY is required" >&2 exit 1 fi # Determine endpoint if [[ -n "$POST_ID" ]]; then ENDPOINT="${GHOST_URL}/ghost/api/admin/posts/${POST_ID}/" METHOD="PUT" else ENDPOINT="${GHOST_URL}/ghost/api/admin/posts/" METHOD="POST" fi RESPONSE=$(curl -s -w "\n%{http_code}" -X "$METHOD" \ -H "Authorization: Ghost ${KEY}" \ -H "Content-Type: application/json" \ -d "$POST_JSON" \ "$ENDPOINT") ``` `scripts/posts.sh:34,41-57`: ```bash --ghost-url) GHOST_URL="${2:-}"; shift 2 ;; if [[ -z "$GHOST_URL" ]]; then echo "Error: --ghost-url or GHOST_URL is required" >&2 exit 1 fi if [[ -z "$ADMIN_API_KEY" ]]; then echo "Error: --api-key or GHOST_ADMIN_API_KEY is required" >&2 exit 1 fi # Extract actual key from id:key format KEY="${ADMIN_API_KEY##*:}" RESPONSE=$(curl -s -w "\n%{http_code}" \ -H "Authorization: Ghost ${KEY}" \ -H "Content-Type: application/json" \ "${GHOST_URL}/ghost/api/admin/posts/?limit=${LIMIT}&page=${PAGE}&filter=status:${STATUS}&include=tags,authors") ``` ### Technical Analysis The scripts only check whether `GHOST_URL` is nonempty. They do not require the `https://` scheme, reject plaintext `http://`, validate the hostname, reject embedded URL credentials, or restrict requests to a trusted destination. Every API request includes an administrative authorization credential. Some requ ...[truncated 2158 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code is narrowly focused on creating or updating a post via the Ghost Admin API. It can set title, markdown content, excerpt, publish status, featured flag, and attach tags to the post payload. However, the declared description claims broader capabilities: support for both the Content API and Admin API, management of tags as a standalone capability, and fetching site analytics. None of those broader capabilities appear in this code chunk. While the post-creation/publishing portion matches the description, the declared purpose materially overstates the implemented behavior for this supplied code.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description presents a broader Ghost CMS management skill covering content creation/publishing, tag management, analytics, and both Content and Admin APIs. The supplied code only performs a single read operation: fetching/listing posts from the Ghost Admin API with optional formatting. It does not create or publish posts, manage tags, access analytics, or interact with the Content API. This is a material description-to-behavior mismatch because the implemented capability is significantly narrower and different from the declared multifunction management purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description presents a broader Ghost CMS content-management capability, including creating/publishing posts, tag management, and support for both Content and Admin APIs. The actual code chunk only performs read-only retrieval of data from Admin API endpoints for posts, members, and site metadata, and summarizes counts. It does not implement content creation, publishing, tag management, or any Content API access. While fetching site stats is partially aligned with the description, the supplied code’s actual behavior is substantially narrower than the declared purpose, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The description presents a broader Ghost CMS management skill covering posts, publishing, tags, analytics, and both Content and Admin APIs. The supplied code chunk is limited to tag operations through the Admin API: listing tags, retrieving a tag by slug, and creating tags. It does not create or publish posts, does not fetch analytics, and does not use the Content API at all. While tag management is accurately represented, the overall declared purpose materially overstates the implemented functionality for this code chunk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises shell-based commands that can use authenticated Ghost admin credentials, but it does not declare any explicit tool scope such as allowed-tools or permissions. That increases the chance an agent can invoke shell broadly rather than within a constrained boundary, which is dangerous because the shell can access environment secrets and perform unintended actions beyond the documented Ghost workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill provides commands that can create and immediately publish live CMS content using an authenticated admin key, but it does not clearly warn that these are production-modifying operations. In an agentic setting, lack of an explicit destructive-action warning increases the risk of accidental publication, content defacement, or unauthorized changes when the skill is invoked with real credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script accepts the Ghost Admin API key via the --api-key command-line option, which can expose the secret through process listings, shell history, audit logs, or job runner telemetry visible to other local users or administrators. In a CMS-management skill, this is especially sensitive because the Admin API key enables authenticated content management and could allow unauthorized post creation, modification, or publication if disclosed.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/new-post.sh (reported line 100)May include surrounding context.

sh
METHOD="POST"
fi

RESPONSE=$(curl -s -w "\n%{http_code}" -X "$METHOD" \
  -H "Authorization: Ghost ${KEY}" \
  -H "Content-Type: application/json" \
  -d "$POST_JSON" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The script reads the Ghost Admin API key from an environment variable, which is a sensitive credential access path. Although the usage text documents how to supply the key, there is no warning or disclosure about handling an admin credential with elevated access or the sensitivity of passing it on the command line/environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file header says the script gets 'posts, members, and pageviews if available,' which aligns with the manifest's analytics claim. In practice, the implementation only calls the Admin API endpoints for posts, members, and site data, and the final output contains only posts and members counts with no pageview metrics.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tags.sh (reported line 138)May include surrounding context.

sh
}]
      }')

    RESPONSE=$(curl -s -w "\n%{http_code}" -X POST \
      -H "Authorization: Ghost ${KEY}" \
      -H "Content-Type: application/json" \
      -d "$TAG_JSON" \

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The documentation does not clearly warn that tag operations can alter live taxonomy and that tags may be auto-created during post creation. This can lead to unintended metadata sprawl, broken editorial conventions, or unauthorized content classification changes in production.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The script sends an authenticated HTTP request to the Ghost Admin API using the provided site URL and admin key. While this is core to the script's purpose, the file does not explicitly warn users that it will transmit authentication data to the configured endpoint, which is a relevant disclosure for a safety audit.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

This is an intent-code divergence in the file's own documentation. The comment explicitly promises pageview statistics, yet no later code accesses an analytics or pageviews endpoint, making the documentation materially inaccurate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.