Security audit

Hugo博客发布免费版

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a Hugo blog publishing helper, but it gives broad automatic write, read, commit, and push instructions without clear user confirmation.

Install only if you are comfortable with an agent reading local blog configuration, editing Hugo content, creating taxonomy files, and potentially committing and pushing to a remote Git repository. Before using it, require explicit confirmation of the blog path, files to change, draft/publish state, and whether git push is allowed.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill documentation broadens a narrowly scoped Hugo single-article publishing tool into generic create/query/modify/delete/export operations. This scope drift is dangerous because it can cause an agent to apply the skill to unrelated tasks and perform unintended file or repository actions beyond the user's expected publishing workflow.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The free edition is described as focused on single-article publishing, but later documentation advertises batch publishing. This inconsistency can mislead an agent into making bulk repository changes, increasing the blast radius of mistakes or unauthorized content publication.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The trigger conditions say the skill should be used for marketing copy, writing, title optimization, and content creation, which contradicts its stated Hugo publishing purpose. Overbroad triggers increase the chance that the skill is invoked in unrelated contexts where it may read files, modify content, or push changes unnecessarily.

Vague Triggers

High

Confidence: 93% confidence
Finding: The trigger conditions are so broad and inconsistent that an agent could select this skill for many unrelated writing tasks. Because the skill also includes exec-capable repository modification and push workflows, over-selection can lead to unintended command execution and unwanted publication actions.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The example invocation phrase is vague enough that the skill may be triggered from a broad user request without establishing scope, repository target, or authorization to modify files. In a skill with exec and Git push capabilities, ambiguous invocation increases the risk of unintended actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill promises automatic file creation/modification and Git push behavior without a clear warning or approval checkpoint for repository changes. In this context, silent add/commit/push operations can publish content, alter history, or leak sensitive work to a remote repository without informed user consent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill states it will automatically read memory files and Git configuration to discover blog settings, but does not clearly warn users about this access. This creates a privacy and data-minimization issue because the agent may inspect sensitive local metadata or user notes beyond what is necessary for the immediate task.

Hidden Instructions

High

Category: Prompt Injection
Content: |----|---|----| | 内容分析 | 自动提取标题、标签、分类 | `帮我发布这篇博客` | | Front Matter 生成 | 生成 Hugo 标准格式 | 自动创建 YAML 头部 | | 截断标记 | 自动添加 `` | 列表页显示摘要 | | Git 推送 | 自动提交并推送 | `git push` | | 标签映射 | 英文 slug 映射中文显示 | 自动创建 `_index.md` | **技术实现要点**：核心能力基于`input_params`参数与`output_format`配置实现,支持创建/查询/修改/删除等操作模式,通过`config_options`进行运行时配置.
Confidence: 72% confidence
Finding: The file mixes user-facing Hugo publishing guidance with generic hidden operational instructions about parameter-driven modes such as create/query/modify/delete. Even if not overtly malicious, this hidden instruction pattern can steer agent behavior beyond the visible, expected workflow and reduce transparency around what actions the skill may take.

Static analysis

No suspicious patterns detected.