Security audit

youmind-ghost-article

Security checks across malware telemetry and agentic risk

Overview

This is not shown to be malware, but it can act on a connected Ghost site and includes under-disclosed destructive and broad file/API capabilities.

Install only if you trust the publisher and intend to connect it to your YouMind/Ghost publishing workflow. Keep it in draft-first use, verify the target site and post status before any publish/unpublish/delete action, avoid giving it sensitive local file paths as feature images, and treat ~/.youmind drafts/profile data as shared persistent content.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares executable Bash tools that can install packages and run Node code, and the workflow explicitly depends on networked APIs and local configuration files, yet there is no explicit permissions model describing network access or environment/config access. This creates a transparency and containment gap: users and hosting platforms may underestimate the skill's ability to read sensitive local config and make outbound requests with API-backed side effects such as publishing content.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description frames the skill mainly as an article-writing and publishing tool, but the instructions also cover broader content-management and data-access operations including listing posts, changing status of existing posts, deleting posts, using YouMind data sources, saving content back into YouMind, and generating images. This mismatch is dangerous because users may authorize or invoke the skill expecting limited drafting behavior while it can perform materially broader and potentially destructive actions on connected accounts and content.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The CLI exposes administrative actions far beyond the advertised article-writing and publishing workflow, including listing, fetching, publishing, unpublishing, and deleting arbitrary posts by ID. In an agent-skill context, this expands authority unnecessarily and increases the blast radius if the skill is invoked with attacker-controlled input or used under overly broad user trust assumptions.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Permanent deletion of Ghost posts is a destructive capability not justified by the skill's stated purpose of writing and publishing articles. Even though the command requires --yes, that is only a weak friction control; an agent or user can still be induced to delete arbitrary content by ID, causing irreversible data loss or content sabotage.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The client exposes delete, unpublish, update, list, and validation operations in addition to creating and publishing posts, which is broader than the manifest implies. In an agent-skill context, this expands the capability surface and can enable unintended destructive or privacy-impacting actions if higher-level tooling or prompts invoke these functions without clear user consent.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The code invokes /createChat in agent mode with an instruction to load a tool and then polls /listMessages for tool output. Using a general-purpose agent/tool-execution path in a Ghost publishing skill expands the trusted capability surface and can enable unintended tool use or prompt-driven side effects if the upstream agent has access to more tools than expected.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README documents commands that can directly publish or unpublish Ghost posts but does not clearly warn that these actions affect live site content and may immediately change public visibility. In a publishing skill, this increases the chance of accidental production-impacting actions by users or agents acting with insufficient confirmation.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger set includes broad phrases such as 'ghost post', 'write ghost', and 'ghost blog' that may match ordinary conversation about Ghost or general writing tasks. Overbroad routing increases the chance that this skill activates in contexts where the user did not intend publishing, account access, or content-management actions, which is especially risky given the connected Ghost and YouMind operations.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The pipeline explicitly instructs the agent to read a local configuration file for `youmind.api_key` and use it to validate a remote Ghost connection, but it does not mention any user notice, consent prompt, or disclosure around accessing local secrets. In an agent skill, silent credential access is risky because users may not expect local secret material to be read automatically, and any future prompt-injection or logging mistake could expose or misuse that credential.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The publishing flow performs remote state-changing actions such as `createPost`, `publishPost`, `unpublishPost`, and optional archiving, yet the pipeline does not require an explicit confirmation step warning the user that content will be created, modified, published, or archived on external services. In a content-publishing skill, this is dangerous because an ambiguous prompt, model error, or malicious upstream content could cause unintended public publication or destructive content state changes.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The Markdown renderer is configured with `html: true`, which allows raw HTML from untrusted Markdown to pass straight into the generated Ghost-ready HTML. In this skill, article content can plausibly come from users or AI-generated/researched material, so an attacker could inject scripts, event handlers, malicious iframes, or other active HTML that may execute in Ghost admin previews or on the published site depending on downstream sanitization.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The uploadImage function reads any caller-supplied local path, base64-encodes the file, and transmits it to a remote API. In an LLM agent setting, this is dangerous because an attacker may coerce the agent into uploading arbitrary local files under the guise of a feature image, resulting in local file exfiltration to an external service.

Session Persistence

Medium

Category: Rogue Agent
Content: ## Draft Location Rule **Canonical:** write local article Markdown files to `~/.youmind/articles/ghost/<slug>.md`. This shared home directory is available to all YouMind skills — see [`shared/YOUMIND_HOME.md`](shared/YOUMIND_HOME.md). **Legacy fallback** (if `~/.youmind/` is not writable): `skills/youmind-ghost-article/output/<slug>.md`.
Confidence: 90% confidence
Finding: write local article Markdown files to `~/.youmind/articles/ghost/<slug>.md`. This shared home directory is available to all YouMind skills — see [`shared/YOUMIND_HOME.md`](shared/YOUMIND_HOME.md). **

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 84% confidence
Finding: The trigger 'write ghost' is broad and may conflict with generic built-in 'write' flows, causing this skill to intercept ordinary writing requests. Because the skill can research, access connected services, and ultimately publish or manage Ghost content, accidental invocation could lead to unintended file writes, network calls, or content operations under the wrong workflow.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/api-reference.md:12

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: shared/config.example.yaml:2