Auto Sec Blogger

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 1.0.1

Overview

This is a plausible blog automation skill, but it can automatically publish Notion-approved content to GitHub Pages using broad local Git actions without enough runtime safeguards.

Install only if you intentionally want an agent to write to Notion and publish to a GitHub Pages repository. Use dedicated low-privilege Notion and GitHub credentials, point it at a test or dedicated blog repo, inspect Notion approvals and git diffs before enabling pushes, avoid the background publisher unless continuous publishing is required, and pin or remove the runtime npx Mermaid renderer before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (23)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
                # Mermaid CLI 실행
                result = subprocess.run([
                    'npx', '-y', '@mermaid-js/mermaid-cli',
                    '-i', mmd_file,
                    '-o', str(output_file),

• Confidence: 89% confidence
• Finding: The code invokes an external toolchain via `npx -y @mermaid-js/mermaid-cli` on untrusted Mermaid content. Even though `shell=False` avoids classic shell injection, this still expands the attack surface to a Node-based renderer and a package fetched/executed through `npx`, which can expose the host to parser/renderer vulnerabilities or unexpected network/package-supply-chain behavior.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.run(['git', 'commit', '-m', commit_msg], cwd=self.blog_path, check=True)

            # 푸시
            subprocess.run(['git', 'push', 'origin', 'main'], cwd=self.blog_path, check=True)

            print(f"✅ Git push 완료: {len(filenames)}개 포스트")
            return True

• Confidence: 83% confidence
• Finding: This code performs a remote git push automatically, which can publish content to an external repository without any confirmation, dry-run, or trust validation of the target repository. In an agent-skill context, automatic exfiltration or unintended publication is more dangerous because execution may be triggered on behalf of a user with preconfigured credentials.

Tainted flow: 'blog_repo_path' from os.getenv (line 152, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

# Git operations
        print("\n[Git] Adding changes...")
        subprocess.run(['git', 'add', '.'],
                      cwd=blog_repo_path,
                      check=True,
                      capture_output=True)

• Confidence: 85% confidence
• Finding: blog_repo_path is derived from environment data and is used as the working directory for git commands without validation. If an attacker can influence BLOG_REPO_PATH or the referenced directory contents, they may redirect operations into a malicious repository where git hooks or repository configuration can trigger unintended code execution or cause unauthorized staging of files.

Tainted flow: 'blog_repo_path' from os.getenv (line 152, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

capture_output=True)

        print("[Git] Committing...")
        subprocess.run(['git', 'commit', '-m', f"feat: 블로그 글 추가 - {title}"],
                      cwd=blog_repo_path,
                      check=True,
                      capture_output=True)

• Confidence: 87% confidence
• Finding: The unvalidated environment-controlled working directory is especially sensitive for git commit because local hooks such as pre-commit or commit-msg may execute automatically in the chosen repository. In a skill that automatically pulls data from Notion and commits it, this increases the danger because the script is designed to run unattended with access to developer credentials and local files.

Tainted flow: 'blog_repo_path' from os.getenv (line 152, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

capture_output=True)

        print("[Git] Pushing to remote...")
        subprocess.run(['git', 'push', 'origin', 'main'],
                      cwd=blog_repo_path,
                      check=True,
                      capture_output=True)

• Confidence: 83% confidence
• Finding: Using an environment-derived repository path for git push can send committed content from an attacker-chosen repository or remote, potentially leaking data or publishing unauthorized material. In this automation context, a bad path could cause credentialed pushes to an unintended remote under the user's existing git authentication.

Tainted flow: 'md_file' from os.getenv (line 88, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

{content}
"""

        with open(md_file, 'w', encoding='utf-8') as f:
            f.write(front_matter)

        print(f"✓ Created: {md_file}")

• Confidence: 89% confidence
• Finding: The markdown output path is derived from blog_repo_path and metadata-controlled category/slug values, then written without validating that the final resolved path stays within the intended repository subtree. An attacker controlling environment variables or article metadata could influence file creation locations, leading to unauthorized file overwrite within accessible paths.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The module claims publishing happens after user approval, but the implementation automatically publishes anything returned as review-complete, with no approval check in this component. That mismatch can mislead operators into trusting an approval boundary that does not actually exist, increasing the chance of unauthorized or accidental publication.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list includes broad phrases like content-generation/blog-writing terms that can match ordinary user requests and invoke this skill unexpectedly. Because the skill can collect external content, send data to third-party APIs, and eventually publish to external systems, accidental activation increases the risk of unintended data transmission or automated publication.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill describes collecting news, generating posts with an external LLM, and publishing through Notion/GitHub, but it does not clearly warn that article content, prompts, metadata, and possibly user-supplied material will be transmitted to external services. Users may provide sensitive drafts, internal analysis, or unpublished content without realizing it will leave the local environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow states that approved content is pushed via Git and deployed to GitHub Pages, but it does not provide a strong warning that this can make content publicly accessible and trigger automated downstream actions. In a blogging skill, publication is the core function, so omission of explicit deployment-effect warnings materially increases the chance of accidental public disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script automatically converts remote Notion content into local files and pushes them to the main branch with no approval gate, dry-run mode, or branch isolation. In this context, that creates a real integrity risk: compromised Notion content, mistaken status changes, or malicious metadata can be published directly to production infrastructure.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The code writes files derived from article fields and an environment-controlled base path without any user confirmation or repository-boundary validation. In an agent setting, silent file creation can unexpectedly modify local content and, combined with untrusted article metadata such as category, may write outside the intended content subtree if path components are not sanitized.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: This routine stages, commits, and pushes changes to a remote repository without any prior user warning, confirmation, or policy check. In a skill/agent context, automatic publication is especially risky because it can irreversibly leak content or trigger unwanted external side effects using the user's existing git credentials.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code writes content derived from Notion directly into the repository without any interactive warning or execution-time confirmation. In a skill that can turn remote content into published files, the lack of a final user-facing gate increases the risk of accidental publication, content poisoning, or unintended modification of tracked files.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This execution path commits and pushes to the remote repository automatically, without a clear user-facing confirmation at the moment of action. Because push likely triggers GitHub Actions deployment, any mistake or malicious content from the upstream content source can immediately become a live site change.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This script performs live creation of a Notion page and updates its status without any confirmation, dry-run mode, or environment gating. In an agent or automation context, that can cause unintended modification of production data, clutter remote systems, and trigger downstream publishing workflows without the operator realizing it.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code sends article titles, sources, and summaries to an external LLM service without any visible consent, disclosure, or data-classification guardrails. If articles contain proprietary, personal, or embargoed content, this can cause unintended third-party data exposure and compliance issues.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The generation step forwards article titles, URLs, topic context, and perspective to the external LLM without any notice or minimization. This broadens the data shared externally and may leak source relationships, internal URLs, or sensitive editorial context beyond what is necessary.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code sends article source, title, URL, and summary to an external LLM service via `self.client.chat(...)` without any visible consent, minimization, redaction, or policy enforcement in this component. If article data can contain unpublished, proprietary, or sensitive information, this creates a real data disclosure risk to a third-party processor and may violate privacy or compliance expectations.

Ssd 4

Medium

• Confidence: 94% confidence
• Finding: Untrusted article titles and summaries are inserted directly into the LLM prompt, allowing prompt injection through content that appears to be ordinary news text. A malicious article could steer grouping, induce malformed JSON, override instructions, or bias subsequent analysis in ways the system treats as trusted output.

Ssd 4

Medium

• Confidence: 95% confidence
• Finding: Passing article titles and URLs verbatim into the blog-generation prompt allows attacker-controlled metadata to influence the generated article's style, instructions, or references. In this context, the model is producing long-form content, so prompt steering can more easily redirect tone, insert unwanted content, or manipulate attribution and conclusions.

External Transmission

Medium

• Category: Data Exfiltration

Content

# GLM API
GLM_API_KEY=your_glm_api_key
GLM_BASE_URL=https://api.z.ai/api/coding/paas/v4

# Notion
NOTION_API_KEY=ntn_xxx

• Confidence: 90% confidence
• Finding: The skill is designed to transmit prompts and content to an external LLM endpoint and also integrates with external services like Notion and GitHub. External transmission is expected in this context, but it is still security-relevant because sensitive user content, metadata, or internal analysis may be sent off-platform without sufficient disclosure or minimization.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

---
name: auto-sec-blogger
version: 1.1.0
description: AI-powered security blog automation system (identical to github.com/rebugui/intelligence-agent). Collects news from Google News, arXiv, HackerNews → generates blog posts with GLM-4.7 → publishes to Notion → auto-deploys to GitHub Pages via Git. Features Human-in-the-Loop approval workflow. Use when you want to automate blog writing, news collection, or content generation with the exact functionality of the original intelligence-agent repository. Triggers: "블로그 글 작성", "보안 뉴스 발행", "깃헙 블로그 발행", "intelligence agent", "지능형 에이전트", "자동 글쓰기".
---

# Intelligence Agent

• Confidence: 86% confidence
• Finding: The description advertises auto-deployment behavior, which introduces autonomous action affecting external systems and public outputs. Although the file also mentions a human-in-the-loop approval workflow, the skill still presents a meaningful risk if approvals are weak, misconfigured, or triggered in the wrong context, because it can commit, push, and publish content automatically.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.