Security audit

Halo Blog Manager

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it advertises for Halo blog administration, but it stores reusable login credentials and session cookies on disk while enabling publish/delete actions with limited guardrails.

Review before installing. Use only with a Halo account whose permissions you are comfortable exposing to the agent, avoid shared machines, protect or delete ~/halo-manager/config.json and ~/halo-manager/session.json after use, and manually confirm any publish, delete, upload, or comment-moderation action.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly instructs the agent to read and write local files and make authenticated network requests, yet it declares no permissions. This creates a transparency and governance gap: users and the platform may not realize the skill can persist credentials/session material locally and perform remote blog operations, increasing the chance of overprivileged or unexpected execution.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The trigger phrases include broad terms such as 'manage blog' and general Halo-related wording that may cause the skill to activate for loosely related requests. In a skill that can authenticate, modify content, delete posts/comments, and store credentials, accidental invocation increases the risk of unintended sensitive actions.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill instructs storing the user's blog URL, username, and password in plaintext in ~/halo-manager/config.json and session state in a local file. Plaintext credential storage is dangerous because any local process, backup, malware, shared account user, or accidental file exposure can recover reusable credentials and session artifacts, enabling full compromise of the user's Halo blog.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The PowerShell login example handles CSRF tokens, public keys, encrypted passwords, and an authenticated session without any warning about secure storage, redaction, or operational hygiene. In practice, users may hardcode credentials, expose session objects in logs/history, or reuse the example insecurely, which can lead to credential or session leakage.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script stores the blog URL, username, and password in plaintext in a predictable directory under the user's home folder. Any local process, malware, backup system, shared account, or accidental file disclosure can recover reusable credentials and gain persistent access to the Halo CMS account. In the context of a blog-management skill with create/edit/delete capabilities, compromise of these credentials can lead to full account takeover and destructive content changes.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script serializes authenticated session cookies to disk, effectively creating a bearer token cache that may allow reuse of an already-authenticated session without the password. If another local user or process reads this file, they may be able to impersonate the user until the session expires, bypassing normal login controls. Because this skill manages a CMS, stolen session state could be used to modify posts, media, comments, or administrative settings.

Static analysis

No suspicious patterns detected.