ghst for Ghost

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:36 AM UTC
• Version: 1.0.3

Overview

This skill is a clearly documented Ghost admin CLI wrapper, but users should treat it as powerful because it can change live site content and member data.

Install only if you intend to let an agent administer your Ghost site. Use a dedicated low-privilege Ghost staff account, pin and review the @tryghost/ghst version instead of using floating npm/npx installs, keep the token out of chat and version control, and require explicit approval before deletes, publishing, bulk changes, imports/exports, settings changes, webhooks, or raw API calls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned npm Dependency Is Installed and Executed

Content

View full analysis

**Security**: Always install `@tryghost/ghst` from the official npm registry (`https://www.npmjs.com/package/@tryghost/ghst`). Consider pinning to a specific, reviewed version rather than relying on whatever version resolves at runtime (e.g., `npm install -g @tryghost/ghst@1.2.3`). Keep the package updated intentionally and review release notes before upgrading. ### Docker / Containerized Environments If you are running OpenClaw in Docker, ensure the `ghst` binary is included in your container image by adding the installation command to your `Dockerfile`: ```dockerfile RUN npm install -g @tryghost/ghst ``` ``` ### Technical Analysis The installation metadata, `npm install`, `npx`, and Docker examples all resolve `@tryghost/ghst` without specifying an exact reviewed version or package integrity value. Consequently, the code executed during installation or invocation can change after the Skill itself has been audited. The document acknowledges this risk and recommends considering version pinning, but the executable metadata and default examples remain unpinned. Installing from the official npm registry reduces dependency-confusion and typosquatting exposure, but it does not protect against a compromised maintainer account, malicious upstream release ...[truncated 1579 chars]

Remediation

View remediation

" command: "npx --yes @tryghost/ghst@" ``` 2. Update every npm, npx, and Docker example to use the same exact version: ```bash npm install -g @tryghost/ghst@ npx --yes @tryghost/ghst@ --help ``` 3. Use a lockfile and verified package integrity hashes where the deployment mechanism supports them. 4. Build and scan a fixed container image in a controlled pipeline rather than dynamically installing the latest package at runtime. 5. Disable unnecessary npm lifecycle scripts during installation where compatible: ```bash npm install --ignore-scripts -g @tryghost/ghst@ ``` If lifecycle scripts are required, inspect them before approving the package version. 6. Upgrade only through an explicit review process that verifies release notes, package provenance, published contents, and integrity metadata. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:75

Finding

Privileged Ghost Staff Token Stored in Plaintext Configuration

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

## Configuration & Authentication

To interact with a Ghost instance, the agent requires a Ghost API URL and a Ghost Staff Access Token. There are two main ways to achieve this within the ghst skill:

1. **Explicit flags**: `--url` and `--staff-token`
2. **Environment variables**: `GHOST_URL` and `GHOST_STAFF_ACCESS_TOKEN`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

## Configuration & Authentication

To interact with a Ghost instance, the agent requires a Ghost API URL and a Ghost Staff Access Token. There are two main ways to achieve this within the ghst skill:

1. **Explicit flags**: `--url` and `--staff-token`
2. **Environment variables**: `GHOST_URL` and `GHOST_STAFF_ACCESS_TOKEN`

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md

- `ghst socialweb delete`
    - `ghst auth logout`
    - `ghst auth link` (when replacing active link)
- **File Safety**: CLI tools like `member export` and `migrate export` will refuse to overwrite existing files. Check for file existence before exporting if necessary.
- **Security Check**: Never print or output sensitive tokens (e.g., values coming from `ghst auth token` or `config --show-secrets`) into the chat unprompted. Treat them as privileged credentials.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README advertises that the skill can broadly manage a Ghost instance but does not clearly warn that it can make destructive or high-impact changes to live site content, configuration, themes, members, and other administrative resources. In an agent context, understated documentation can cause users or downstream systems to grant the skill powerful permissions without understanding the modification risk, increasing the chance of accidental misuse.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill recommends executing npx @tryghost/ghst without pinning a specific version. That causes runtime resolution of whatever package version is current, which creates a supply-chain risk: a compromised upstream release or dependency could execute arbitrary code in the agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This is a second unpinned npx @tryghost/ghst execution path, so it carries the same supply-chain exposure as line 21. Because npx may fetch code at execution time, an attacker who compromises the package or its dependency chain could gain code execution on the host.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill explicitly recommends creating a dedicated Ghost staff account and persistent access token for agent use. While framed as least-privilege guidance, this still establishes durable credentials for autonomous use; if the agent environment, config file, or host is compromised, the attacker gains ongoing authenticated access to the Ghost instance.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

### Staff Account & Token Security

To minimize risk, create a **dedicated Ghost staff account** specifically for agent access and grant it only the **least privileges** required (e.g., Author or Editor rather than Owner). Store the `GHOST_STAFF_ACCESS_TOKEN` securely—never commit it to version control or expose it in chat logs. If the token is ever leaked, rotate it immediately via the Ghost Admin panel, and disable or remove the token when the agent no longer needs access.

### Instructions for Bot Owners

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file documents commands that create, update, delete, import, and export member data, but it does not include any warning about modifying or removing user data or handling potentially sensitive member information. Because the description presents these operations without cautions about data impact, privacy, or reversibility, it lacks the user-facing warning expected for safety-relevant behaviors in markdown skill documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation advertises destructive and account-affecting operations such as delete, block/unblock, follow/unfollow, and enable/disable without any warning about side effects, confirmation expectations, or safe usage guidance. In a skill intended to drive a Ghost Admin-capable CLI, this omission increases the chance that an agent or user will invoke state-changing actions unintentionally, leading to content loss, account changes, or social-web misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file documents hide, show, and especially delete commands, but it provides no warning that these actions change moderation state or may permanently remove comment data. For markdown files, user-facing descriptions should disclose behaviors that can affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents a delete command, which is a destructive operation that could affect user data or system configuration. The description provides no warning, confirmation note, or caution about the impact of deleting a label.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The bulk command implies actions that may modify multiple labels at once, which can have broader impact than single-item operations. The markdown does not disclose any caution about scope, reversibility, or the need to review targets before running bulk changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file documents a page deletion command but provides no warning that the operation removes content and may be irreversible. Under the markdown-specific warning rule, user-facing documentation should disclose behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file documents actions such as create, update, delete, publish, schedule, unschedule, copy, and bulk operations, but it provides no warning that these commands can modify or remove Ghost content. For markdown files, the skill description should disclose behaviours that may affect user data or system integrity, especially destructive actions like deletion and bulk changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file documents a command that activates a Ghost theme, which can immediately affect site appearance and potentially disrupt a production site. The description provides no warning or caution about the operational impact of switching themes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The dev command watches files and auto-uploads changes, which can continuously modify remote theme assets and impact user data or site integrity during development. The documentation does not disclose this behavior or warn users about its effect on connected environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.