Poetize Blog Automation

• Outcome: Pass
• Latest audit: Jul 27, 2026 · 6:10 PM UTC
• Version: 2.2.0

Overview

This is a disclosed POETIZE blog-admin automation skill with real publishing and credential risks, but the sensitive behavior matches its stated purpose and is documented.

Install only for a POETIZE instance you control. Prefer framework secret storage or environment variables, use a revocable least-privilege API key, avoid local skill-folder credentials unless necessary, review every local image path before publishing, and explicitly confirm live changes such as publishing, comments, SEO/theme changes, taxonomy deletion, or payment configuration.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The config command writes `base_url` and `api_key` directly into generated JSON or `.env` files without enforcing restrictive permissions or clearly warning that long-lived secrets are being persisted to disk. In agent/automation environments, these files are commonly committed, indexed, or left world-readable, which can expose the API key and enable unauthorized blog administration.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This publishing tool automatically resolves local image references in Markdown and uploads the referenced files to the remote blog API by default. In an AI-agent automation context, that can exfiltrate unintended local files if generated or supplied Markdown includes local paths, especially because the upload behavior is implicit rather than requiring a per-operation confirmation.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This script writes a generated JSON config containing entry["apiKey"] to disk without any warning, permission hardening, or guidance on secure storage. In a blog automation skill that uses persistent authentication, this increases the chance that long-lived credentials are stored in plaintext in world-readable locations, committed to source control, or exposed through backups and logs.

External Transmission

Medium

• Category: Data Exfiltration

Content

last_error: str = ""
    for attempt in range(1, max_retries + 1):
        try:
            response = requests.post(
                url, headers=headers, json=payload, timeout=timeout, stream=stream
            )
            response.raise_for_status()

• Confidence: 83% confidence
• Finding: This script sends the full SKILL.md content and user intents to an external OpenAI-compatible API endpoint. In the context of a blog automation skill with authentication persistence and operational instructions, that can expose sensitive workflow details, internal paths, or embedded secrets if SKILL.md or prompts ever contain them, and the destination base URL is operator-controlled rather than tightly constrained.

Credential Access

High

• Category: Privilege Escalation

Content

filesystem:
    - skill folder read/write
    - user-provided markdown/config/credential files
    - ~/.config/poetize/credentials.json for persisted auth
  environment:
    - POETIZE_BASE_URL
    - POETIZE_API_KEY

• Confidence: 87% confidence
• Finding: The skill is explicitly designed to access high-privilege credentials from environment variables and persisted files such as `~/.config/poetize/credentials.json`. Even though this is part of the intended workflow, any skill with read/write access to admin credentials materially increases the blast radius if the skill is misused, compromised, or chained with another flaw.

Credential Access

High

• Category: Privilege Escalation

Content

- Or put `{baseDir}` on `PATH` and call `poetize-blog.sh` directly. Python 3 is still required at runtime (declared in `requires.anyBins`); the wrapper auto-selects `py` / `python3` / `python`.
- Invoke this skill only for explicit POETIZE tasks, not generic writing or SEO requests.
- Generate framework config with `poetize-blog.sh config`: `--format openclaw` for OpenClaw, `--format env` for IDE agents or shell.
- Credential persistence — choose by what survives a restart in your runtime, not by product name (WorkBuddy/Trae Work/Cursor/Qoder each span local+cloud): (1) framework injects `POETIZE_*` env (OpenClaw, Hermes, QwenPaw) → no action; (2) home dir persists (Trae/Cursor/CodeBuddy desktop, VS Code) → `auth login` global; (3) only skill folder persists (ima copilot, Doubao, cloud agents) → `auth login --local` (`{baseDir}/credentials.json`).
- Credential resolution priority: CLI args > env vars (`POETIZE_BASE_URL` / `POETIZE_API_KEY`) > global file (`~/.config/poetize/credentials.json`) > local file (`{baseDir}/credentials.json`). CWD discovery was removed; never place `credentials.json` in a working directory.
- Run `poetize-blog.sh smoke-test` before the first real write action in a new environment.
- Set `POETIZE_BASE_URL` to the public domain origin without trailing `/api`; requests resolve under `${POETIZE_BASE_URL}/api/api/...`.

• Confidence: 90% confidence
• Finding: This is a real credential-handling risk because the skill encourages persistent storage of admin credentials in both global and local `credentials.json` files, including in the skill directory for some runtimes. Storing long-lived secrets in reusable locations increases exposure to accidental disclosure, cross-session leakage, backup/sync leakage, and compromise by other tools with filesystem access.

Credential Access

High

• Category: Privilege Escalation

Content

filesystem:
    - skill folder read/write
    - user-provided markdown/config files
    - ~/.config/poetize/credentials.json for persisted auth (0600)
  environment:
    - POETIZE_BASE_URL
    - POETIZE_API_KEY

• Confidence: 94% confidence
• Finding: The skill is explicitly granted access to persisted authentication material in ~/.config/poetize/credentials.json and also to POETIZE_API_KEY via environment variables. Even though this is likely intended to support blog automation, it creates a real secret-exposure risk because any compromised skill logic, prompt injection, or overly broad file handling could read, misuse, or exfiltrate long-lived credentials.

Credential Access

High

• Category: Privilege Escalation

Content

# ---------------------------------------------------------------------------

try:
    CREDENTIALS_PATH = Path.home() / ".config" / "poetize" / "credentials.json"
except Exception:
    CREDENTIALS_PATH = None

• Confidence: 88% confidence
• Finding: The skill resolves a global credential file in the user's home directory and later uses it automatically for non-auth commands. Persisted API keys increase the blast radius of local compromise, and automatic loading can cause unintended use of powerful credentials by an agent session without fresh user intent.

Credential Access

High

• Category: Privilege Escalation

Content

except Exception:
    CREDENTIALS_PATH = None

LOCAL_CREDENTIALS_PATH = Path(__file__).resolve().parent.parent / "credentials.json"


def load_credentials() -> dict[str, str]:

• Confidence: 95% confidence
• Finding: A local fallback `credentials.json` in the skill directory is especially risky because repositories and skill folders are more likely to be shared, synced, or accidentally committed than per-user config paths. Any exposed API key would grant blog-management capabilities including publishing, modifying, hiding content, and changing SEO/theme settings.

Session Persistence

Medium

• Category: Rogue Agent

Content

label: "Install Python 3 (brew)"
permissions:
  filesystem:
    - skill folder read/write
    - user-provided markdown/config/credential files
    - ~/.config/poetize/credentials.json for persisted auth
  environment:

• Confidence: 84% confidence
• Finding: The skill includes deliberate session persistence by writing credentials and user-provided content/config files to disk, including `~/.config/poetize/credentials.json`. Persistent auth materially increases the chance of unintended reuse across sessions, lateral access by other local processes, and stale privileged sessions remaining active longer than necessary.

Session Persistence

Medium

• Category: Rogue Agent

Content

permissions:
  filesystem:
    - skill folder read/write
    - user-provided markdown/config files
    - ~/.config/poetize/credentials.json for persisted auth (0600)
  environment:

• Confidence: 79% confidence
• Finding: The skill has write access to its folder, user-provided markdown/config files, and a persistent path under ~/.config for auth storage. This is a genuine persistence risk because the skill can modify local state across sessions, potentially planting altered configs, tampering with content, or preserving unauthorized access material beyond the user's immediate interaction.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.