Blog Content Publish

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:38 AM UTC
• Version: 1.0.8

Overview

The skill’s publishing workflow is coherent, but it asks users to install and run an unpinned global third-party CLI with credentials that can publish content and sync skills.

Review and pin the `@leeguoo/blog-publish` package before installing, prefer a project-local install where possible, and run it with least-privileged publishing credentials. Confirm the target site, locale, input files, and `clawhub:sync:all` effects before allowing real publish, update, upload, or sync commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:127

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 127
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Complete Code Snippet:

sh

pnpm add -g @leeguoo/blog-publish

Technical Analysis

The skill instructs users or agents to globally install @leeguoo/blog-publish without specifying an exact version, lockfile, package integrity hash, or provenance verification. The effective code executed by this instruction can therefore change after the skill has been reviewed.

Package installation may execute npm lifecycle scripts, and subsequent use of the installed CLI executes code supplied by the package and its transitive dependencies. Because the package implementation is not included in the audited project, its behavior cannot be verified from this artifact. Global installation also makes the command available outside the immediate project context.

This is a supply-chain weakness rather than evidence that the named package is currently malicious.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or a transitive dependency.
2. The attacker publishes a malicious version that satisfies the unpinned installation request.
3. A user or automation agent follows the skill instruction and runs the global installation command.
4. pnpm retrieves the attacker-controlled release and may execute its lifecycle code.
5. The installed CLI subsequently runs with the invoking user's privileges.
6. Malicious code could inspect accessible files, environment variables, or publishing credentials and perform unauthorized local or network operations.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user or CI identity running pnpm. The accessible scope may include local content, environment variables such as publishing tokens, account-level publishing capabilities, and othe ...[truncated 135 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to an exact, reviewed version, for example @leeguoo/blog-publish@X.Y.Z.
• Prefer a project-local development dependency over a global installation.
• Commit a lockfile and use a frozen or immutable installation mode in automation.
• Verify npm package provenance, release signatures, and integrity metadata before installation.
• Disable lifecycle scripts during installation when they are unnecessary, then explicitly review any required scripts.
• Run the CLI in a sandbox or least-privileged CI job with narrowly scoped publishing credentials.
• Establish an upgrade process that reviews and tests each new package version before changing the pin.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language guidance hardcodes --locale zh in operational commands and elsewhere states only that single-language submit is supported, without telling users they may choose another locale. This can violate language/locale policy because it nudges operators toward a specific language by default rather than presenting locale selection as an opt-in choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.