ClawHub
Back to skill

Security audit

youmind-hashnode-article

Security checks for vulnerabilities and agentic risk

Overview

This Hashnode publishing skill mostly matches its stated purpose, but it includes under-disclosed destructive delete commands and can send the YouMind API key to an arbitrary configured API endpoint.

Review this skill before installing. Use it only with a trusted YouMind API key, keep base_url set to https://youmind.com/openapi/v1 unless you intentionally use a local test backend, prefer draft-first publishing, and be aware that the package contains permanent delete commands not shown in the main docs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
toolkit/src/config.ts:77
Finding

Unrestricted API Base URL Can Redirect or Expose the YouMind API Key

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
toolkit/package.json:17
Finding

Dependency Installation Is Not Reproducible Because No Lockfile Is Present

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
Findings (58)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Most of the declared functionality is accurately represented: the code supports draft-first publishing, immediate publishing, published-post listing, draft listing, tag lookup, connectivity validation, and content adaptation/preview. However, the code also exposes additional substantive capabilities not mentioned in the description: deleting drafts, deleting published posts, and retrieving individual posts/drafts by ID. The deletion commands are especially material because they are destructive account/content operations and are not implied by the stated purpose. Also, the description mentions 'clear connector / pricing guidance when the user's Hashnode account is not ready inside YouMind,' but this specific guidance behavior is not evident in the shown code beyond generic config/connectivity error messages. Therefore the description does not fully and accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents an end-to-end Hashnode integration skill with YouMind/OpenAPI operations for writing, publishing, draft management, post listing, tag lookup, and user guidance when the account is not ready. The supplied code chunk instead only performs content adaptation and validation on markdown and metadata. While this adapter is plausibly a supporting component for a Hashnode publishing skill, the actual behavior of this chunk is materially narrower than the declared purpose and does not implement the key claimed capabilities or any network/API interactions. Therefore this is a mismatch between declared functionality and observed code behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is specifically about writing and publishing Hashnode articles through YouMind, including draft-first publishing, listing published posts and drafts, tag lookup, and readiness/pricing guidance. The supplied code does none of the Hashnode-specific operations: there are no Hashnode endpoints, no publish/update post flow, no draft vs published post listing, no tag lookup, and no account-status guidance logic. Instead, the code is a reusable YouMind client for search, storage, browsing internal content, and even image generation. This is a material purpose mismatch, with multiple undeclared capabilities unrelated to the stated Hashnode connector behavior.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md
Do not ask the user to fill local `hashnode.token` or `hashnode.publication_id`. That flow is obsolete.

## Draft Output Rule

All locally generated article files must go under `output/`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
| `toolkit/src/cli.ts` | Real CLI used for validate / publish / list flows |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
| `toolkit/src/hashnode-api.ts` | YouMind OpenAPI client for Hashnode |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · shared/YOUMIND_HOME.md (reported line 34)May include surrounding context.

md
1. `~/.youmind/config/<skill>.yaml`
2. `~/.youmind/config.yaml`

This is now a hard requirement. Article skills do **not** read repo-local `config.yaml` files or `~/.youmind-skill/credentials.yaml` anymore.

## Canonical Files

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · shared/YOUMIND_HOME.md (reported line 46)May include surrounding context.

md
1. `~/.youmind/config/<skill>.yaml`
2. `~/.youmind/config.yaml`

This is now a hard requirement. Article skills do **not** read repo-local `config.yaml` files or `~/.youmind-skill/credentials.yaml` anymore.

## Canonical Files

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · toolkit/src/cli.ts (reported line 260)May include surrounding context.

ts
}
        console.log('');
      } else {
        console.log('No warnings. Article looks good for Hashnode!\n');
      }

      const outputPath = opts.output ? resolve(opts.output) : getDefaultPreviewOutput(filePath);

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file implements chat-based image generation through a general-purpose agent mode (message_mode: 'agent') even though the declared skill is for Hashnode article publishing. This unnecessary capability expansion increases the attack surface, enables unintended outbound requests and tool use, and violates least-privilege for the skill's stated purpose.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

npm install npm run build cd .. mkdir -p ~/.youmind/config cp shared/config.example.yaml ~/.youmind/config.yaml

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README_CN.md (reported line 21)May include surrounding context.

npm install npm run build cd .. mkdir -p ~/.youmind/config cp shared/config.example.yaml ~/.youmind/config.yaml

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README_CN.md (reported line 21)May include surrounding context.

npm install npm run build cd .. mkdir -p ~/.youmind/config cp shared/config.example.yaml ~/.youmind/config.yaml

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README documents a --publish path for directly making content public, but it does not include an explicit warning that this action has immediate public/irreversible effects. In a publishing skill, that increases the chance of accidental disclosure of drafts, sensitive content, or unreviewed material, especially because the same tool also supports safer draft-first workflows.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: youmind-hashnode-article
version: 1.0.0
description: |
  Write and publish Hashnode articles through YouMind OpenAPI. Supports draft-first
  publishing, published post listing, draft listing, tag lookup, and clear connector / pricing
  guidance when the user's Hashnode account is not ready inside YouMind.
triggers:

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md
This skill has no skill-specific overrides. All commands read `youmind.api_key` and `youmind.base_url` from `~/.youmind/config.yaml`. Keep the documented domain as `https://youmind.com/openapi/v1`. If you test against a local `youapi`, override `~/.youmind/config.yaml` — never the docs.

Do not ask the user to fill local `hashnode.token` or `hashnode.publication_id`. That flow is obsolete.

## Draft Output Rule

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

Reading ~/.youmind/author-profile.yaml introduces cross-session and potentially cross-skill persistence of user profile data. Even if intended for convenience, this can create privacy risk, unexpected personalization, or leakage of sensitive writing preferences if the shared file contains more than the skill strictly needs.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
This skill is **self-contained and fully usable standalone.** The `youmind-article-dispatch` hub is an optional companion; it is NOT required for anything.

- **Primary mode — standalone:** Invoke directly ("Write a Hashnode article about X"). Works with zero other YouMind skills installed.
- **Author voice lookup:** This skill reads `~/.youmind/author-profile.yaml` (shared home directory — see `shared/YOUMIND_HOME.md`) for cross-platform voice preferences. Works whether or not dispatch is installed.
- **Optional dispatch-mode invocation:** When dispatch invokes this skill with a content brief containing `resolved_author`, the skill uses those fields as extra context. Without such a brief, the skill runs its own pipeline normally. Hashnode's depth-first DNA stays native to this skill.
- **Capability manifest (opt-in):** `dispatch-capabilities.yaml` is metadata that lets dispatch route intelligently. Deleting it reverts to defaults; it never breaks this skill.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md
1. **Self-critique**: Pass all checklist items in the playbook's Step 6
2. **Conformance report**: Generate and present to user (Step 7/8)
3. **Canonical URL**: Set correctly for cross-posts (trailing slash matters)
4. **User approval**: Do not auto-publish without confirmation

### Result Links Rule

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The translation section instructs that technical terms should be kept in English as an industry standard. This imposes a language choice on translated output without offering the user a preference or explaining a region-specific requirement, which conflicts with the policy against forced language/locale constraints.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · shared/DISPATCH_CONTRACT.md (reported line 143)May include surrounding context.

md
Platform skills MUST work in both modes:

### Standalone mode
User invokes the platform skill directly (`"Write an article about X for this platform"`):
- No content brief is provided
- Skill follows its own pipeline from scratch
- **Fallback for author DNA**: skill MAY read `~/.youmind/author-profile.yaml` to apply user voice/preferences. If the shared profile does not exist, proceed with platform defaults. Legacy fallback paths are optional migration aids, not the canonical location.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · shared/DISPATCH_CONTRACT.md (reported line 171)May include surrounding context.

md
| File | Owned by | Purpose |
|------|----------|---------|
| `shared/DISPATCH_CONTRACT.md` (this file) | Shared | The interface definition |
| `skills/youmind-article-dispatch/SKILL.md` | Hub | Hub behavior, onboarding, dispatch pipeline |
| `skills/youmind-article-dispatch/references/content-brief-format.md` | Hub | Brief schema detail |
| `~/.youmind/author-profile.yaml` | Shared user home | User's cross-platform author DNA |
| `~/.youmind/dispatch-roster.yaml` | Shared user home | User's active platform list |