ClawHub
Back to skill

Security audit

Mailchimp To Ghost

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated Mailchimp-to-Ghost purpose, but it can mutate Ghost content with an admin token and has an unsafe title-based lookup that could target the wrong post.

Install only if you are comfortable giving the skill Ghost Staff API access. Check and change the hardcoded RSS_URL before use, review the generated markdown before syncing, and avoid --update or --force until the title filter is escaped or replaced with a safer lookup.

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
        # Use NQL filter to search for posts with similar title
        # The ~ operator does a partial match
        result = subprocess.run(
            [GHST_BIN, "post", "list", "--filter", f"title:~'{title[:30]}'", "--json"],
            capture_output=True,
            text=True,
Confidence
92% confidence
Finding
The code builds a Ghost CLI filter argument directly from newsletter-derived title text using embedded single quotes. Even though subprocess.run is called without a shell, this is still an argument-injection risk against the ghst/NQL parser: crafted title content can break out of the intended filter expression, alter query semantics, or cause unexpected matches/behavior in the downstream tool.

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill documentation describes substantial capabilities including shell execution, network access, and file read/write operations, but it does not declare any permissions for those behaviors. This creates a transparency and policy-enforcement gap: users or an execution framework may authorize or sandbox the skill incorrectly, increasing the chance of unintended filesystem changes, external data exfiltration, or command execution with more trust than warranted.

Unvalidated Output Injection

High
Category
Output Handling
Content
try:
        # Use NQL filter to search for posts with similar title
        # The ~ operator does a partial match
        result = subprocess.run(
            [GHST_BIN, "post", "list", "--filter", f"title:~'{title[:30]}'", "--json"],
            capture_output=True,
            text=True,
Confidence
94% confidence
Finding
This is a true unvalidated output injection issue into a downstream CLI/query language rather than the OS shell. Newsletter-controlled title text is embedded into the NQL filter string, so malicious quoting or operators could change which posts are enumerated or selected for follow-on logic, increasing the chance of unintended duplicate suppression or wrong-post updates in a publishing workflow.

Static analysis

No suspicious patterns detected.