Security audit

Hugo博客发布免费版

Security checks for vulnerabilities and agentic risk

Overview

This Hugo publishing skill is mostly purpose-aligned, but it can automatically modify and push a blog repository while using broad triggers and under-disclosed local data access.

Install only if you intend to let the agent manage a Hugo blog repository. Before use, restrict it to a specific trusted blog path, require confirmation before any file write, git commit, or git push, and avoid allowing automatic reads of memory files or git configuration unless you have reviewed what they contain.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims command execution is safe because it does not concatenate user input, but its own documented workflow interpolates user-controlled values such as article titles, file names, slugs, and blog paths into shell commands like git commit, sed, cd, and file creation. In an MD+EXEC skill, this mismatch is dangerous because a malicious title or path can trigger command injection or unintended repository modifications if not safely quoted and validated.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger language is overly broad for a skill that can write files and execute git commands, increasing the chance that the agent activates it for ordinary writing or coding requests outside the user's intent. In context, overbroad activation is risky because the skill is not read-only; it can modify repositories and push changes remotely.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The stated activation condition includes general content creation and title optimization scenarios, which extends far beyond Hugo blog publishing. Because the skill includes repository-changing behavior, this ambiguity raises the likelihood of accidental invocation and unintended file or git operations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill describes creating files, modifying content, committing changes, and pushing to a remote repository, but it does not provide a prominent upfront warning that it will perform state-changing repository operations. In an agent environment with exec capability, this can lead to unintended publication, data loss, or remote disclosure if users believe they are only asking for drafting help.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill says it will automatically read MEMORY.md, USER.md, and .git configuration to discover blog settings, but it does not clearly disclose the privacy implications or request consent first. This is risky because those sources may contain sensitive personal data, repository remotes, usernames, email addresses, or tokens that are unrelated to the immediate task.

Static analysis

No suspicious patterns detected.