ClawHub
Back to skill

Security audit

CNBlogs Publisher

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it ships unsafe credential handling and disables HTTPS certificate checks while performing authenticated blog actions.

Review before installing. Do not use the bundled test credentials, assume the exposed token is compromised, and avoid running tests/test_all.sh against a real account. This skill should remove hardcoded secrets, stop disabling TLS verification, add explicit confirmation for publishing or other live writes, and give safer token-storage guidance before normal use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
tests/test_all.sh:4
Finding

Hardcoded CNBlogs API Credential in Test Script

Content
View full analysis

Vulnerability Details

File Location: tests/test_all.sh:4-6
Vulnerability Type: Hardcoded access token and account information
Risk Level: High

Vulnerable Code

bash
export CNBLOGS_BLOG_URL="https://rpc.cnblogs.com/metaweblog/sueyyyy"
export CNBLOGS_USERNAME="suyang320"
export CNBLOGS_TOKEN="03989364193E50C002FD667C5F016FC00423F010502BC4958DC3EA953527806A"

Technical Analysis

The test script contains a plaintext CNBlogs MetaWeblog access token alongside the corresponding username and API endpoint. A credential committed to a project must be considered compromised because it can be recovered from distributed copies, archives, logs, or version-control history even if it is removed in a later revision.

The project's scripts pass this token to authenticated XML-RPC methods that can retrieve, create, edit, publish, and delete posts. If the token remains valid, possession of the project is potentially sufficient to perform operations under the affected CNBlogs account.

Attack Path

  1. An attacker obtains a copy of the project or its version-control history.
  2. The attacker reads tests/test_all.sh and extracts the API endpoint, username, and token.
  3. The attacker submits the credentials to the CNBlogs MetaWeblog endpoint.
  4. The attacker invokes supported methods such as getRecentPosts, getPost, newPost, editPost, or deletePost.
  5. Depending on the token's server-side privileges and validity, the attacker reads private drafts or modifies, publishes, and deletes blog content.

Impact Assessment

The exposed token may grant authenticated access to the associated CNBlogs account's MetaWeblog functionality. Potential impact includes disclosure of posts and drafts, unauthorized content creation, modification or publication of existing content, and deletion of posts. The scope is limited by the permissions assigned to the exposed token and whether CNBlogs has already revoked it.

Remediation
View remediation

Remediation Suggestions

  1. Immediately revoke the exposed CNBlogs token and generate a replacement.
  2. Remove the credential from the current tree and purge it from version-control history using an appropriate history-rewriting tool.
  3. Require test credentials to be supplied through protected environment variables or a dedicated secret manager.
  4. Commit only a placeholder configuration, such as CNBLOGS_TOKEN="your-token".
  5. Restrict the replacement token to the minimum permissions supported by CNBlogs.
  6. Add automated secret scanning to local hooks and CI pipelines.
  7. Review account activity for unauthorized API operations performed with the exposed token.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/save_draft.py:22
Finding

TLS Certificate Verification Disabled for Authenticated XML-RPC Requests

Content
View full analysis

Vulnerability Details

File Locations:

  • scripts/delete_post.py:16-23
  • scripts/get_blog_info.py:16-24
  • scripts/get_post.py:16-23
  • scripts/publish.py:16-23
  • scripts/save_draft.py:22-30
  • scripts/update_draft.py:16-23

Vulnerability Type: Improper certificate validation
Risk Level: High

Vulnerable Code

Representative complete implementation from scripts/save_draft.py:22-30:

python
class CustomTransport(Transport):
    """Custom transport for SSL handling"""
    def __init__(self):
        super().__init__()
        self.context = ssl._create_unverified_context()

    def make_connection(self, host):
        import http.client
        return http.client.HTTPSConnection(host, context=self.context)

The same unverified TLS transport pattern is used in the other listed scripts.

Technical Analysis

ssl._create_unverified_context() disables certificate-chain and hostname verification. Consequently, HTTPS encryption does not establish the identity of the remote CNBlogs server.

Each affected script transmits the CNBlogs username and access token through XML-RPC. Several scripts also transmit or receive article content. An attacker capable of intercepting network traffic can present an arbitrary certificate, terminate the connection, and observe or manipulate authenticated requests and responses without triggering certificate validation errors.

Attack Path

  1. A user runs an affected script on a network controlled or observable by an attacker.
  2. The attacker intercepts traffic through a malicious access point, compromised proxy, DNS manipulation, or another network-position attack.
  3. The attacker presents a certificate that is not valid for the intended CNBlogs endpoint.
  4. The custom transport accepts the certificate because verification is disabled.
  5. The attacker captures the XML-RPC request containing the username, token, and potentially private ar ...[truncated 538 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the custom unverified transport and allow xmlrpc.client.ServerProxy to use Python's verified HTTPS defaults.
  2. If a custom context is necessary, use ssl.create_default_context() rather than ssl._create_unverified_context().
  3. Ensure both certificate-chain validation and hostname verification remain enabled.
  4. Do not add fallback behavior that silently retries with verification disabled.
  5. Provide an explicit CA bundle only when a legitimate private CA is required.
  6. Apply the correction consistently to every affected script and centralize transport construction to prevent implementation drift.
  7. Add tests confirming that expired, self-signed, and hostname-mismatched certificates are rejected.

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:188
Finding

Documentation Encourages Plaintext Persistent Token Storage

Content
View full analysis

Vulnerability Details

File Location: README.md:188
Vulnerability Type: Insecure credential storage guidance
Risk Level: Medium

Vulnerable Code

bash
echo 'export CNBLOGS_TOKEN="your-metaweblog-token"' >> ~/.zshrc

Technical Analysis

The documentation instructs users to persist a long-lived API token directly in a shell startup file. Shell profiles are plaintext files and are frequently copied into backups, diagnostic bundles, dotfile repositories, or shared development environments. They may also be readable by local processes operating under the user's account.

Environment variables exported by a startup file are inherited by subsequently launched processes, unnecessarily increasing the number of applications exposed to the credential.

Attack Path

  1. A user follows the documented setup command and stores a real token in ~/.zshrc.
  2. The shell profile is exposed through a dotfile repository, backup, support archive, malicious local process, or account compromise.
  3. An attacker extracts the token from the plaintext profile.
  4. The attacker combines it with the corresponding username and MetaWeblog endpoint.
  5. The attacker submits authenticated XML-RPC requests and performs operations allowed by the token.

Impact Assessment

Exposure of the persisted token may permit unauthorized access to the user's CNBlogs MetaWeblog API. The resulting scope can include reading drafts and creating, editing, publishing, or deleting posts, subject to the token's actual permissions. Because a shell profile is loaded repeatedly, the credential also remains exposed until manually removed and rotated.

Remediation
View remediation

Remediation Suggestions

  1. Replace the shell-profile recommendation with an OS credential manager or dedicated secret-management solution.
  2. If file-based storage is unavoidable, use a separate credential file with restrictive permissions and ensure it is excluded from version control and backups where appropriate.
  3. Load credentials only for the command or session that requires them rather than exporting them globally to every descendant process.
  4. Document token rotation and revocation procedures.
  5. Warn users never to commit tokens to dotfile repositories, scripts, examples, or test fixtures.
  6. Recommend narrowly scoped, short-lived credentials if CNBlogs supports them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (36)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description says the skill manages CNBlogs articles through write-oriented operations such as saving drafts, publishing, updating, and deleting posts. However, this code chunk is a diagnostic/read-only utility: it validates configuration, connects to the XML-RPC API, retrieves the user's blogs, categories, and recent posts, and can probe multiple candidate API URLs. That is a materially different primary purpose from article management. While both concern CNBlogs MetaWeblog API access, the implemented behavior is informational/testing rather than post lifecycle management, so the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code's actual function is to call metaWeblog.getPost and display article details. This is materially different from the declared set of supported actions, which are all write/manage operations: save drafts, publish, update, and delete posts. While both relate to CNBlogs articles through the MetaWeblog API, the implemented capability here is a read operation that is not mentioned in the description, and none of the declared management actions appear in this chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description says the skill manages CNBlogs articles with support for save drafts, publish, update, and delete posts. However, the supplied code only performs a read operation: it calls metaWeblog.getRecentPosts to fetch recent posts (including drafts) and prints them. There is no code for creating, publishing, updating, or deleting posts. This is a material description-behavior mismatch because the actual primary behavior is listing posts/drafts, while the declared supported management actions are absent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description claims a broader article-management skill covering draft save, publish, update, and delete. This code chunk only performs one narrow operation: publish an existing post identified by post ID. It first reads the post, then republishes it with publish=True, preserving existing content fields. There is no implementation here for creating drafts, updating arbitrary content, or deleting posts. Additionally, the script is explicitly invoked from the command line with a required post-id argument, which is a concrete trigger not reflected in the declaration. The custom transport also disables SSL verification, which is not the primary purpose but is a notable undeclared behavior affecting how external resources are accessed. Overall, the supplied code does not accurately match the full declared capability set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The code is broadly related to CNBlogs management, so the overall domain matches. However, this specific code chunk does more than the declared description states: it retrieves blog information, lists recent posts/drafts, and fetches individual post contents, whereas the description only mentions save draft, publish, update, and delete. It also hardcodes and uses CNBlogs authentication credentials, which is a sensitive access pattern not reflected by the empty declared permissions. While some read operations could be considered supporting functionality, the presence of undeclared read/list capabilities plus embedded secrets makes the description incomplete relative to the actual behavior.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The custom transport creates an unverified SSL context, disabling TLS certificate validation for all HTTPS requests to the MetaWeblog endpoint. This allows a man-in-the-middle attacker or malicious network proxy to intercept credentials and tamper with API responses, which is especially dangerous because the script performs authenticated destructive actions like deleting posts.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The custom transport disables TLS certificate verification via ssl._create_unverified_context(), then uses that channel to send the CNBlogs username and token to the remote API. This allows a man-in-the-middle attacker to intercept credentials or alter API responses, which is especially dangerous in a publishing skill that can expose account access and blog content.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The test script hardcodes and exports a live CNBlogs blog URL, username, and API token directly in source. This exposes real credentials to anyone with repository or filesystem access and enables unauthorized reading, publishing, updating, or deleting blog content via the MetaWeblog API.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README presents all user-facing instructions in Chinese from the title onward, and nowhere indicates that the skill is China-specific or that users may choose another language. This can violate a language/locale policy when a skill effectively forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs users to export a CNBLOGS_TOKEN but does not warn that it is a sensitive credential with blog-level write access. In operational use, missing guidance can lead to token leakage through shell history, screenshots, shared terminals, CI logs, or copied environment dumps, enabling unauthorized publishing, modification, or deletion of blog content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file's docstring and all user-facing prompts are written in Chinese, and the script provides no option to select another language or indication that it is intentionally limited to a Chinese-only audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The code reads a blog URL, username, and token from environment variables, then uses them in XML-RPC calls to a remote service. While the script prints connection status, it does not clearly disclose that credentials and account data will be sent over the network, and there is no docstring or comment warning about this sensitive operation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The custom transport explicitly creates an unverified SSL context and uses it for HTTPS connections, disabling certificate validation. This allows a man-in-the-middle attacker to intercept or modify XML-RPC traffic and steal the CNBlogs username/token or tamper with blog operations such as listing, editing, publishing, or deleting posts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script's docstring, help output, and status/error messages are all written in Chinese, which forces a specific language for users. There is no opt-in, language selection, or justification that this skill is intended only for a Chinese-speaking or region-specific environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code explicitly creates an unverified TLS context and uses it for the XML-RPC HTTPS connection, disabling certificate validation for all API traffic. This exposes the CNBlogs username, token, and post contents to man-in-the-middle interception or tampering, which is especially dangerous because the skill performs authenticated publish/edit operations against a remote service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The custom transport creates an unverified SSL context via ssl._create_unverified_context(), which disables certificate validation for HTTPS connections. This permits man-in-the-middle attacks against the MetaWeblog API endpoint, potentially exposing the CNBlogs username, token, and blog content or allowing tampering with requests and responses.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The custom transport creates an SSL context with certificate verification explicitly disabled, which defeats HTTPS server authentication. This allows a man-in-the-middle attacker on the network path to intercept or modify the XML-RPC session, exposing the blog token, username, and post content and potentially altering requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code reads a local file and sends its content, along with username and token credentials, to the CNBlogs MetaWeblog API. While the script prints update status, it does not explicitly disclose to the user that the file contents and authentication data are being transmitted to a remote endpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script exports authentication material without any warning, safety note, or explanation that real blog credentials are being used. In the context of a publishing skill, this increases the chance that users run the script without realizing they are exposing sensitive access tokens in their shell environment and test workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The test routine performs a real remote update against an external CNBlogs post as part of normal testing. This makes destructive or state-changing actions easy to trigger accidentally, and if combined with exposed credentials can be abused to tamper with production blog content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The update operation is invoked as a routine test step without a clear warning that it will modify external data on CNBlogs. Users may unintentionally alter or overwrite a real post, which is especially risky in a skill specifically designed to publish and manage content remotely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The test article explicitly advertises capabilities to save drafts, update drafts, and publish articles, but it does not warn that these actions modify remote CNBlogs content through the MetaWeblog API. In a skill that performs authenticated remote publishing, lack of clear disclosure can mislead users or downstream agents into invoking state-changing operations without sufficient caution, increasing the risk of unintended content changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file describes actions including publishing and deleting blog articles, which can affect user data and system state. Under the markdown-specific warning criteria, the description should disclose destructive or irreversible behavior, but no caution or confirmation note is present.

Content

No source excerpt is available for this finding.