Security audit

ghost cms

Security checks for vulnerabilities and agentic risk

Overview

This Ghost CMS skill does what it says, but it grants live blog admin powers and has under-scoped safeguards around credentials, publishing/deletion, API destinations, and remote image fetching.

Install only if you trust the publisher and need agent-assisted Ghost administration. Use a dedicated low-privilege Ghost integration if possible, keep the config file out of version control with restrictive permissions, require explicit human confirmation before publishing or deleting, use only HTTPS Ghost API URLs, and avoid passing untrusted remote feature-image URLs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ghost.py:127
Finding: Arbitrary Remote Image Retrieval Enables SSRF and Internal Data Relay
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ghost.py:144
Finding: Predictable Temporary File Creation Allows Symlink-Based File Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ghost.py:38
Finding: Unvalidated API URL Can Transmit Ghost Administrative Tokens over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:77
Finding: Unpinned Runtime Dependencies Create Supply-Chain and Reproducibility Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (30)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
python3 scripts/ghost.py list --config "../../projects/fuye/ghost-admin.config.json"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
python3 scripts/ghost.py list --config "../../projects/fuye/ghost-admin.config.json"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
python3 scripts/ghost.py list --config "../../projects/fuye/ghost-admin.config.json"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
md
python3 scripts/ghost.py list --config "../../projects/fuye/ghost-admin.config.json"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.
md
python3 scripts/ghost.py list --config "../../projects/fuye/ghost-admin.config.json"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.
md
python3 scripts/ghost.py list --config "../../projects/fuye/ghost-admin.config.json"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.
md
python3 scripts/ghost.py list --config "../../projects/fuye/ghost-admin.config.json"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
md
python3 scripts/ghost.py list --config "../../projects/fuye/ghost-admin.config.json"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.
md
python3 scripts/ghost.py list --config "../../projects/fuye/ghost-admin.config.json"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.
md
python3 scripts/ghost.py list --config "../../projects/fuye/ghost-admin.config.json"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.
md
python3 scripts/ghost.py list --config "../../projects/fuye/ghost-admin.config.json"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.
md
python3 scripts/ghost.py list --config "../../projects/fuye/ghost-admin.config.json"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.
md
python3 scripts/ghost.py list --config "../../projects/fuye/ghost-admin.config.json"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.
md
python3 scripts/ghost.py list --config "../../projects/fuye/ghost-admin.config.json"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.
md
python3 scripts/ghost.py list --config "../../projects/fuye/ghost-admin.config.json"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 87% confidence
Finding: This finding is a duplicate detection of the same issue: the documentation directs users to store the Ghost Admin API key in a JSON config file under a stable project path. That persistence model exposes an administrative secret to unintended disclosure and subsequent unauthorized post creation, modification, or deletion if the file is accessed by another party or tool.
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
3. Click **"Add custom integration"** 4. Copy the **Admin API Key** (format: `id:secret`) ### 2. Create Configuration File **唯一调用方式：自定义配置文件路径（项目隔离）**

Session Persistence

Medium

Category: Rogue Agent
Confidence: 87% confidence
Finding: This finding is a duplicate detection of the same issue: the documentation directs users to store the Ghost Admin API key in a JSON config file under a stable project path. That persistence model exposes an administrative secret to unintended disclosure and subsequent unauthorized post creation, modification, or deletion if the file is accessed by another party or tool.
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
3. Click **"Add custom integration"** 4. Copy the **Admin API Key** (format: `id:secret`) ### 2. Create Configuration File **唯一调用方式:自定义配置文件路径(项目隔离)**

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The examples show immediate publishing with status set to published, but do not warn that content becomes publicly visible right away. In a content-management skill, this can lead to accidental disclosure of draft, sensitive, or unreviewed material through automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill documents deletion of Ghost posts without any warning, confirmation step, or guidance to verify the target post before execution. In an agentic context, this increases the chance of accidental irreversible content loss if a user request is ambiguous or the wrong post ID is supplied.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation contains a real-looking Ghost Admin API key in an environment-variable example. Even if intended as a placeholder, publishing credential-shaped secrets normalizes unsafe secret handling and may result in users copying sensitive values into files or, if the token is real, immediate compromise of the Ghost admin interface.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation provides a delete command example with no warning, confirmation guidance, or mention of irreversibility. In an agent or automation context, this increases the chance of accidental destructive actions against live content, especially if users or downstream tools treat examples as safe defaults.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: User-facing descriptions and runtime messages are consistently presented in Chinese, including the module description and CLI output, with no opt-in or alternative locale support. This creates a natural-language policy concern when a skill imposes a specific language on users without documented justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The docstring states the '唯一方式' is a custom config file path for project isolation, reinforced again in CLI help and errors. In practice, get_config simply expands and opens whatever path the caller supplies, with no restriction to a project directory or any isolation boundary, so the documentation overstates the safety/constraint actually enforced by code.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/ghost.py (reported line 208)May include surrounding context.
python
headers = get_headers(config['admin_api_key']) try: response = requests.post(url, json=post_data, headers=headers) response.raise_for_status() data = response.json()

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/ghost.py (reported line 271)May include surrounding context.
python
# PUT 请求需要带上 ID url = f"{api_url}/posts/{post_id}/?source=html" response = requests.put(url, json=update_data, headers=headers) response.raise_for_status() data = response.json()

Static analysis

No suspicious patterns detected.