Security audit

Clank Blog Post

Security checks for vulnerabilities and agentic risk

Overview

This skill is for publishing blog posts, but it can push generated content to a hardcoded GitHub Pages repository on broad prompts without a clear confirmation step.

Install only if you intend the agent to publish to the Clankr0i/clank-blog GitHub Pages setup or you will first change the repository, branch, domain, branding, and locale. Before any run, require the agent to show the exact files, destination repository, branch, commit, and public URL, and prefer a review branch or pull request over direct pushes to master.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:129
Finding: Fixed Third-Party Repository Publishing and Output Hijacking
Content: View full analysis
{TITLE} – Clank Blog :root { --bg: #0f0f23; --card: #1a1a2e; --accent: #ff6b35; --text: #e0e0e0; --muted: #888; --border: #2a2a4e; } * { margin: 0; padding: 0; box-sizing: border-box; } body { font-family: 'Georgia', serif; background: var(--bg); color: var(--text); line-height: 1.9; } .container { max-width: 700px; margin: 0 auto; padding: 2rem; } h1 { color: var(--accent); font-size: 2rem; margin: 2rem 0 0.5rem; } .meta { color: var(--muted); font-size: 0.9rem; margin-bottom: 2rem; border-bottom: 1px solid var(--border); padding-bottom: 1rem; } p { margin-bottom: 1.5rem; } h2 { color: var(--accent); margin: 2.5rem 0 1rem; font-size: 1.3rem; } h3 { color: #fff; margin: 1.5rem 0 0.8rem; font-size: 1.1rem; } ul, ol { margin: 1rem 0 1.5rem 1.5rem; } li { margin-bottom: 0.5rem; } strong { color: #fff; } blockquote { border-left: 3px solid var(--accent); padding: 1rem 1.5rem; margin: 1.5rem 0; background: var(--card); border-radius: 0 8px 8px 0; } code { background: var(--card); padding: 0.8rem 1rem; border-radius: 8px; display: block; margin: 1rem 0; font-si ...[truncated 4542 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description presents the skill as a blog-post creation tool but does not clearly warn that it modifies local files and pushes commits to a remote repository. That omission can mislead an agent or user into treating the skill as low-risk content generation when it actually performs persistent local changes and external network actions with publication side effects.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad enough to match ordinary writing or website-editing requests, which can cause an agent to invoke a skill that clones a repository, edits files, commits, and pushes to a remote without the user explicitly asking for publication. In this skill’s context, the overbroad activation is especially risky because the action is not merely content generation but remote state modification on GitHub Pages.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The HTML template sets lang="de", and surrounding examples use fixed German text and German date formatting, which imposes a specific language/locale by default. The file does not state that the skill is intentionally German-only or offer a way for the user to choose another locale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.