Security audit

blog-writer-tool-free

Security checks across malware telemetry and agentic risk

Overview

This blog-writing skill is mostly a Markdown guide, but it asks for local command execution and includes under-scoped handling of credentials, network use, and callback URLs.

Review this skill before installing. Use it only if you are comfortable with a writing assistant that can run local commands and may use external APIs or callback URLs. Avoid providing private drafts, internal links, API keys, or sensitive research materials unless the publisher clarifies data handling and command boundaries.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The document makes a strong privacy/safety claim that all data stays local, while elsewhere stating that some features require network access to external APIs. This contradiction can mislead users into supplying sensitive research materials or drafts under false assumptions about data handling, creating privacy and compliance risk.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: A blog-writing skill is granted broad exec capability and includes operational shell guidance that is not narrowly tied to text generation. Excess capability increases the attack surface because prompt-driven workflows can cause the agent to run arbitrary commands unrelated to the stated purpose.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to enumerate environment variables matching API, KEY, TOKEN, or SECRET patterns. Even if the sample masks values, this normalizes access to sensitive credential-bearing environment data in a context where such inspection is unnecessary for a writing assistant, and can be adapted or misused for secret discovery.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation guidance is so broad that the agent may activate the skill for loosely related requests without meaningful trigger constraints. In a skill with exec and network-adjacent behavior, overly permissive activation increases the chance of unnecessary tool use, data exposure, or unsafe command execution.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The scenario coverage description uses vague, expansive keywords that make the skill appear applicable to a wide range of requests beyond its declared purpose. This ambiguity encourages over-triggering and broad interpretation by the agent, which is risky given the presence of exec and external-processing implications.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill exposes exec capability but does not prominently warn users that shell commands may be run on their machine. Lack of disclosure undermines informed consent and can lead users to authorize a benign-seeming writing tool that actually has local command-execution potential.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill accepts user-provided materials, links, and callback URLs but does not clearly warn that this data may be transmitted externally or trigger network interactions. This omission can expose private drafts, research inputs, or internal endpoints without the user's informed understanding.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.