ClawHub
Back to skill

Security audit

Mailchimp To Ghost

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its stated Mailchimp-to-Ghost purpose, but it can mutate Ghost content with an admin token and has an unsafe title-based lookup that could target the wrong post.

Install only if you are comfortable giving the skill Ghost Staff API access. Check and change the hardcoded RSS_URL before use, review the generated markdown before syncing, and avoid --update or --force until the title filter is escaped or replaced with a safer lookup.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
        # Use NQL filter to search for posts with similar title
        # The ~ operator does a partial match
        result = subprocess.run(
            [GHST_BIN, "post", "list", "--filter", f"title:~'{title[:30]}'", "--json"],
            capture_output=True,
            text=True,
Confidence
92% confidence
Finding
result = subprocess.run( [GHST_BIN, "post", "list", "--filter", f"title:~'{title[:30]}'", "--json"], capture_output=True, text=True, check=True

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill documentation describes substantial capabilities including shell execution, network access, and file read/write operations, but it does not declare any permissions for those behaviors. This creates a transparency and policy-enforcement gap: users or an execution framework may authorize or sandbox the skill incorrectly, increasing the chance of unintended filesystem changes, external data exfiltration, or command execution with more trust than warranted.

Unvalidated Output Injection

High
Category
Output Handling
Content
try:
        # Use NQL filter to search for posts with similar title
        # The ~ operator does a partial match
        result = subprocess.run(
            [GHST_BIN, "post", "list", "--filter", f"title:~'{title[:30]}'", "--json"],
            capture_output=True,
            text=True,
Confidence
94% confidence
Finding
subprocess.run( [GHST_BIN, "post", "list", "--filter", f"title:~'{title[:30]}'", "--json"], capture_output

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.