Auto Sec Blogger

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:18 PM UTC
• Version: 1.0.1

Overview

This skill has a coherent blog-automation purpose, but it can automatically publish to Notion and GitHub with overly broad Git and file-write behavior that needs review before installation.

Review this skill before installing. Use only restricted Notion and GitHub credentials, test against a disposable blog repository, require a clean working tree, avoid scripts that run as background publishers, and fix category path validation, git staging scope, dotenv handling, and pinned Mermaid dependencies before live use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/publisher_git.py:104

Finding

Unvalidated Category Values Permit Path Traversal During Blog Publication

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/publisher_git.py:133

Finding

Repository-Wide Git Staging Can Push Unrelated or Sensitive Files

Content

View full analysis

None: # cwd 변경 대신 subprocess의 cwd 파라미터 사용 권장 cmd = ['git', 'add', '.'] subprocess.run(cmd, cwd=self.blog_repo_path, check=True, capture_output=True) ``` Standalone publisher: ```python # Git operations print("\n[Git] Adding changes...") subprocess.run(['git', 'add', '.'], cwd=blog_repo_path, check=True, capture_output=True) ``` ### Technical Analysis The publisher only needs to stage files generated for the current article. Instead, `git add .` stages every eligible modification and untracked file beneath the repository. The command is executed without a shell, so it is not a shell-command injection vulnerability. The security issue is its overly broad authorization scope: unrelated local changes become part of an automated publication commit without review. A `.gitignore` file may reduce exposure but is not a sufficient control. Files that are not ignored, files already tracked by Git, and deliberately force-added or misconfigured sensitive files remain at risk. ### Attack Path 1. A sensitive, malicious, or unrelated file exists in the configured blog repository. 2. The file may have been created by another process, a developer, compromised build tooling, or the path-traversal issue described separately. 3. An approved Notion article triggers the Git publisher. 4. The publisher executes `git add .`. 5. Git stages both the generated article and every other eligible repository change. 6. The publisher creates a commit and executes `git push origin main`. 7. The unrelated content is transferred to the configured Git remote. ### Impact Assessment Potential impact includes: - Disclosu ...[truncated 655 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/notion_publisher.py:76

Finding

Mermaid Conversion Downloads and Executes an Unpinned npm Package at Runtime

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/writer.py:127

Finding

Untrusted News Feed Content Is Embedded in LLM Prompts Without Injection Defenses

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (100)

Tainted flow: 'query_url' from os.getenv (line 46, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/auto_publish_approved.py (reported line 59)May include surrounding context.

python

}
    
    try:
        response = requests.post(query_url, headers=headers, json=payload)
        response.raise_for_status()
        
        data = response.json()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 46)May include surrounding context.

python

# 2. 환경 변수 로드
# 프로젝트 루트의 .env 파일 우선적으로 로드
env_path = PROJECT_ROOT / ".env"
if env_path.exists():
    load_dotenv(env_path, override=True)
else:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 51)May include surrounding context.

python

# 2. 환경 변수 로드
# 프로젝트 루트의 .env 파일 우선적으로 로드
env_path = PROJECT_ROOT / ".env"
if env_path.exists():
    load_dotenv(env_path, override=True)
else:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publisher_git.py (reported line 168)May include surrounding context.

python

# 2. 환경 변수 로드
# 프로젝트 루트의 .env 파일 우선적으로 로드
env_path = PROJECT_ROOT / ".env"
if env_path.exists():
    load_dotenv(env_path, override=True)
else:

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill commits and pushes to the remote repository automatically without any approval checkpoint. In an agent context this is dangerous because simply invoking the skill can publish attacker-controlled or erroneous content to a live site, create irreversible repository history, and potentially leak sensitive material if the workspace contains unintended changes.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

import importlib.util
from dotenv import load_dotenv

# Load .env
env_path = '/Users/nabang/Documents/OpenClaw/.env'
load_dotenv(env_path, override=True)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auto_publish_approved.py (reported line 15)May include surrounding context.

python

import importlib.util
from dotenv import load_dotenv

# Load .env
env_path = '/Users/nabang/Documents/OpenClaw/.env'
load_dotenv(env_path, override=True)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 45)May include surrounding context.

python

import importlib.util
from dotenv import load_dotenv

# Load .env
env_path = '/Users/nabang/Documents/OpenClaw/.env'
load_dotenv(env_path, override=True)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.py (reported line 50)May include surrounding context.

python

import importlib.util
from dotenv import load_dotenv

# Load .env
env_path = '/Users/nabang/Documents/OpenClaw/.env'
load_dotenv(env_path, override=True)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run_git_publisher.py (reported line 13)May include surrounding context.

python

import importlib.util
from dotenv import load_dotenv

# Load .env
env_path = '/Users/nabang/Documents/OpenClaw/.env'
load_dotenv(env_path, override=True)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auto_publish_approved.py (reported line 16)May include surrounding context.

python

from dotenv import load_dotenv

# Load .env
env_path = '/Users/nabang/Documents/OpenClaw/.env'
load_dotenv(env_path, override=True)

# Load NotionPublisher directly

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run_git_publisher.py (reported line 14)May include surrounding context.

python

from dotenv import load_dotenv

# Load .env
env_path = '/Users/nabang/Documents/OpenClaw/.env'
load_dotenv(env_path, override=True)

# Load NotionPublisher directly

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run_pipeline.py (reported line 16)May include surrounding context.

python

from dotenv import load_dotenv

# Load .env
env_path = '/Users/nabang/Documents/OpenClaw/.env'
load_dotenv(env_path, override=True)

# Load NotionPublisher directly

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Automated add/commit/push to main occurs with no explicit confirmation. In this skill context that materially increases danger because externally sourced article content is transformed into repository changes and immediately published, creating a direct path from untrusted input to remote side effects.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The script hard-codes an absolute path to a local .env file and explicitly loads it, which couples execution to a sensitive credential source. In a shared development environment, CI runner, or redistributed skill, this can encourage unsafe secret handling and accidental exposure of API keys or internal filesystem structure.

Content

Scanner excerpt · scripts/test_full_pipeline.py (reported line 11)May include surrounding context.

python

from pathlib import Path
from dotenv import load_dotenv

# Load .env
env_path = '/Users/nabang/Documents/OpenClaw/.env'
load_dotenv(env_path, override=True)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Calling load_dotenv on a hard-coded local path with override=True can overwrite already-set environment variables with values from a file, increasing the chance of using unintended or less secure credentials. This is especially risky in automation or multi-user contexts where environment isolation matters and secrets should be centrally managed.

Content

Scanner excerpt · scripts/test_full_pipeline.py (reported line 12)May include surrounding context.

python

from dotenv import load_dotenv

# Load .env
env_path = '/Users/nabang/Documents/OpenClaw/.env'
load_dotenv(env_path, override=True)

# Load NotionPublisher directly

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The description advertises auto-deployment to GitHub Pages via Git, which is an external side effect affecting a public-facing publishing target. Even with a stated Human-in-the-Loop workflow, broad triggers and automation around content generation and deployment raise the risk of unintended, premature, or manipulated publication.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: auto-sec-blogger
version: 1.1.0
description: AI-powered security blog automation system (identical to github.com/rebugui/intelligence-agent). Collects news from Google News, arXiv, HackerNews → generates blog posts with GLM-4.7 → publishes to Notion → auto-deploys to GitHub Pages via Git. Features Human-in-the-Loop approval workflow. Use when you want to automate blog writing, news collection, or content generation with the exact functionality of the original intelligence-agent repository. Triggers: "블로그 글 작성", "보안 뉴스 발행", "깃헙 블로그 발행", "intelligence agent", "지능형 에이전트", "자동 글쓰기".
---

# Intelligence Agent

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger list includes broad phrases such as '자동 글쓰기' and generic references to 'intelligence agent', which can cause the skill to activate for common writing or automation requests beyond the user's clear intent. In a skill that can collect external data, call APIs, and publish content, overbroad activation increases the chance of unintended execution of external actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The visible user-facing documentation and invocation phrases are primarily in Korean, and the file does not indicate that users may choose another language or that the skill is intentionally limited to a Korean-only audience. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes automated collection, LLM generation, Notion publishing, and Git-based deployment, but does not clearly warn that article content, prompts, metadata, and possibly user-supplied text will be transmitted to third-party services. This creates a meaningful data handling and consent risk because users may provide proprietary or sensitive material without understanding it leaves the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The skill is explicitly configured to transmit data to an external LLM endpoint at api.z.ai, and elsewhere also indicates writes to Notion and GitHub-related services. External transmission is expected for the feature set, but it is still security-relevant because prompts, article content, URLs, and possibly user-provided or internal data may be exposed to third-party infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

# GLM API
GLM_API_KEY=your_glm_api_key
GLM_BASE_URL=https://api.z.ai/api/coding/paas/v4

# Notion
NOTION_API_KEY=ntn_xxx

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The architecture document is written entirely in Korean, including all operational descriptions and workflow instructions, with no indication that language choice is optional or that the skill is intended only for a Korean-speaking context. This can violate a language/locale policy when users are not offered an opt-in or alternative locale.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/architecture.md (reported line 182)May include surrounding context.

md

class NotionPublisher:
    def create_article(self, blog_post):
        # Notion API 호출
        response = requests.post(
            f"https://api.notion.com/v1/pages",
            headers={
                "Authorization": f"Bearer {NOTION_API_KEY}",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The code accesses the NOTION_API_KEY environment variable, which is a sensitive credential. While the script's purpose implies Notion access, there is no user-facing disclosure, prompt, or explicit warning in this file that credentials will be read from the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/auto_publish_approved.py (reported line 59)May include surrounding context.

python

}
    
    try:
        response = requests.post(query_url, headers=headers, json=payload)
        response.raise_for_status()
        
        data = response.json()

Static analysis

No suspicious patterns detected.