Halo Blog Manager

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:11 AM UTC
• Version: 1.0.0

Overview

This Halo CMS manager matches its stated purpose, but it stores admin credentials and session cookies insecurely and can change or delete blog content, so it needs review before installation.

Install only if you are comfortable giving the skill administrative access to your Halo site. Use an HTTPS-only blog URL, avoid reused passwords, restrict or remove ~/halo-manager/config.json and ~/halo-manager/session.json when done, and manually confirm any delete or publish action before allowing it to run.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/halo_login.py:28

Finding

Plaintext Credential and Session Storage Without Enforced File Permissions

Content

View full analysis

dict: """Load credentials from config file.""" if not CONFIG_FILE.exists(): return None with open(CONFIG_FILE, "r") as f: return json.load(f) ``` ```python def save_session(session: requests.Session): """Save session cookies to file.""" ensure_config_dir() cookies = {} for cookie in session.cookies: cookies[cookie.name] = { "value": cookie.value, "domain": cookie.domain, "path": cookie.path } with open(SESSION_FILE, "w") as f: json.dump(cookies, f, indent=2) ``` ### Technical Analysis The application stores the Halo username, password, and authenticated session cookies as unencrypted JSON under `~/halo-manager`. The code does not explicitly assign restrictive permissions to the directory or files. Their effective permissions therefore depend on the process umask, existing file permissions, and local filesystem configuration. The session cookie is itself an authentication bearer secret. Consequently, encrypting only the password sent during login does not protect the account if `session.json` can be read. The use of ordinary `open(..., "w")` also does not protect against unsafe pre-existing files or symbolic links. This behavior is directly related to the Skill's authentication function, but retaining a ...[truncated 1252 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/halo_login.py:62

Finding

Authentication Permitted Over Unencrypted HTTP

Content

View full analysis

requests.Session: """ Login to Halo blog and return authenticated session. """ session = requests.Session() # Step 1: Get login page for CSRF token and public key login_url = f"{blog_url}/login" response = session.get(login_url) response.raise_for_status() html = response.text # Extract CSRF token csrf_match = re.search(r'name="_csrf".*?value="([^"]+)"', html) if not csrf_match: # Try alternative pattern csrf_match = re.search(r']*name="_csrf"[^>]*value="([^"]+)"', html) csrf_token = csrf_match.group(1) if csrf_match else None # Extract RSA public key key_match = re.search(r'publicKey\s*=\s*["\']([^"\']+)["\']', html) if not key_match: # Try to find in script tag key_match = re.search(r'-----BEGIN PUBLIC KEY-----[^-]+-----END PUBLIC KEY-----', html, re.DOTALL) if key_match: public_key = key_match.group(1) if key_match.lastindex else key_match.group(0) else: # Try to get from API key_response = session.get(f"{blog_url}/api/public/key") if key_response.ok: public_key = key_response.json().get("publicKey", "") else: raise ValueError("Could not retrieve RSA public key") # Step 2: Encrypt password encrypted_password = encrypt_password(public_key, password) # Step 3: Login login_data = { "username": username, "password": encrypted_password, "_csrf": csrf_token } headers = { "Content-Type": "application/x-www-form-urlencoded", "Accept": "text/html,application/xhtml+xml" } response = sess ...[truncated 2478 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/halo_login.py:179

Finding

Password Exposed Through Echoed Interactive Input

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs users to store the blog URL, username, and password in plaintext in ~/halo-manager/config.json. Plaintext credential storage materially increases the chance of credential theft through local compromise, backups, accidental exposure, or other processes reading the file, especially because the skill manages a privileged admin interface.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 127)May include surrounding context.

Delete Post

text

DELETE /apis/api.console.halo.run/v1alpha1/posts/{name}

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 279)May include surrounding context.

Delete Comment

text

DELETE /apis/api.console.halo.run/v1alpha1/comments/{name}

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 321)May include surrounding context.

Delete Attachment

text

DELETE /apis/api.console.halo.run/v1alpha1/attachments/{name}

---

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code stores the Halo blog username and password in plaintext JSON under the user's home directory, creating an easy credential theft target for local malware, other local users, backups, or accidental disclosure. In this skill context, those credentials grant administrative blog access, so compromise could lead to unauthorized post changes, content deletion, media access, or broader CMS abuse.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill requests capabilities implied by its instructions (local file read/write for config and session storage, plus network access to the Halo API) but does not declare any explicit tool scope or permission boundaries. This creates ambiguity about what the agent may access and increases the risk of overbroad file or network operations beyond the intended blog-management use case.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase 'manage blog' is overly generic and may cause the skill to activate for unrelated blogging or content-management requests. Mis-triggering a skill with network and file-writing behavior is risky because it may solicit credentials or perform actions in the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill exposes destructive operations such as deleting posts, categories, tags, comments, and attachments without requiring explicit confirmation or warning about irreversibility. In a content-management context, accidental or ambiguous execution could lead to permanent data loss or administrative changes the user did not intend.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The output template is entirely in Chinese and is presented as the required output format, which effectively forces a specific language. There is no indication that this locale is optional, user-selectable, or required for a region-specific compliance reason.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file documents a post deletion endpoint but does not include any warning that invoking it will remove user content. Under the markdown-file criteria for missing user warnings, descriptions of behaviors that affect user data or system integrity should disclose the impact of destructive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation lists a delete-comment API operation but provides no caution that it removes stored user-generated content. For markdown skill documentation, destructive behaviors that affect user data should be accompanied by an explicit warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This section documents deletion of attachments yet gives no warning that files may be permanently removed and could break references elsewhere in the system. Markdown documentation should disclose destructive or integrity-affecting behaviors when describing such operations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 9)May include surrounding context.

bash

# First, login to get session cookie
curl -c cookies.txt -b cookies.txt \
  -X GET "https://blog.example.com/apis/api.console.halo.run/v1alpha1/posts?page=1&size=10" \
  -H "Accept: application/json"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file includes a DELETE request that removes a post, but the surrounding documentation provides no warning that the action is destructive or potentially irreversible. Under the markdown-specific warning criteria, examples that can affect user data or system integrity should disclose that risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The PowerShell login example demonstrates collecting a CSRF token, encrypting a password, and submitting login credentials, but the markdown provides no user-facing warning about handling sensitive credentials or avoiding hardcoded real secrets. Because the description exposes a credential-use workflow, a privacy and safety warning is expected in markdown guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script serializes authenticated session cookies to a local file without protection or user warning, which can allow session hijacking if the file is read by another process, user, or malware. Because this skill manages Halo CMS operations, stolen cookies may let an attacker act as the authenticated blog administrator without knowing the password until the session expires.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The create and update examples set publish: true, which can immediately make content publicly visible, yet the markdown does not warn users about that effect. This is a user-data and system-integrity impacting behavior that should be disclosed in example documentation.

Content

No source excerpt is available for this finding.