ClawHub
Back to skill

Security audit

Ghost CMS

Security checks for vulnerabilities and agentic risk

Overview

This Ghost CMS skill is coherent documentation for development and administration, with some examples users should treat carefully because they can install tools globally or change a real Ghost site.

Before installing, understand that this is a documentation-heavy Ghost CMS skill. Use staging or localhost for Admin API examples, confirm before running create/edit/delete or publish commands, avoid substituting real secrets into command-line examples, and prefer pinned project-local npm tools over global latest installs when possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:34
Finding

Unpinned Global npm Package Installation Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:34 and SKILL.md:680
Vulnerability Type: Unpinned global third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
npm install -g ghost-cli@latest
bash
npm install -g gscan

Technical Analysis

The Skill instructs users to install third-party npm packages globally without pinning reviewed versions. The ghost-cli@latest specification explicitly resolves to a mutable release, while the unversioned gscan command also resolves to the registry's current version.

npm packages and their transitive dependencies may run lifecycle scripts during installation. Because these packages are installed globally, malicious installation behavior would execute with the privileges of the user running npm and could affect globally available commands. The effective code installed by these instructions can change after the Skill has been audited, without any corresponding change to this repository.

The installation of Ghost CLI and GScan is relevant to the declared Ghost CMS functionality, but global, mutable installation exceeds the minimum necessary dependency scope. Project-local, version-pinned tools would reduce the affected environment and make installations reproducible.

Attack Path

  1. An attacker compromises a future release of ghost-cli, gscan, or one of their transitive dependencies.
  2. The compromised package is published under the version selected by @latest or by the unversioned npm resolution.
  3. A user follows the Skill and runs the global installation command.
  4. npm downloads the compromised package and may execute its lifecycle scripts.
  5. Malicious code runs with the installing user's privileges and may modify user files, access credentials available to that account, or replace globally installed tooling.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user ...[truncated 432 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin each tool to an exact version that has been reviewed:
    bash
    npm install --save-dev ghost-cli@<reviewed-exact-version>
npm install --save-dev gscan@<reviewed-exact-version>
  2. Prefer project-local installation and invoke the tools through npm exec or package scripts rather than modifying the user's global tool environment.
  3. Commit and enforce a lockfile so direct and transitive dependency versions are reproducible.
  4. Use npm ci in automated environments and verify package provenance and integrity before upgrading.
  5. Avoid running npm installation commands with sudo or an administrator account.
  6. Where compatible, disable lifecycle scripts with --ignore-scripts; if lifecycle scripts are required, review them before installation.
  7. Establish an explicit update process in which new versions are audited before the pinned version is changed.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:777
Finding

Database Password Passed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:777
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

bash
ghost install --db=mysql --dbhost=localhost --dbuser=ghost --dbpass=password --dbname=ghost_prod

Technical Analysis

The production installation example places the database password directly in a command-line argument. Although password is a placeholder rather than a real credential, users may replace it with a production secret and execute the command as written.

Command-line secrets can be retained in shell history, terminal transcripts, CI logs, support bundles, and command auditing systems. Depending on the operating system and process configuration, arguments may also be visible to other local users through process-inspection facilities while the command is running.

Database credentials are necessary for the declared production installation workflow, but exposing them in process arguments is not necessary. An interactive prompt or protected secret source would satisfy the functionality with less disclosure.

Attack Path

  1. An administrator copies the documented command and replaces password with a real production database password.
  2. The shell records the complete command in its history, or an automation platform captures it in logs.
  3. A local user, support operator, monitoring service, backup reader, or log consumer obtains access to that record.
  4. The exposed password is combined with the documented database username, host, and database name.
  5. The attacker authenticates to the database wherever network and access-control rules permit it.

Impact Assessment

The maximum impact is bounded by the privileges assigned to the ghost database account and the database's network exposure. A credential with ordinary Ghost application privileges could permit reading, modifying, or deleting Gho ...[truncated 328 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the password-bearing production command from the documentation.
  2. Prefer the Ghost installer's interactive password prompt so the secret is not entered as a command-line argument.
  3. If automation is required, retrieve the password from an approved secret manager and pass it through a mechanism that does not expose it in process listings or logs.
  4. Ensure secret files are readable only by the required service account and are excluded from source control.
  5. Disable command tracing around secret-handling steps and configure CI systems to redact sensitive values.
  6. Review and purge shell histories or logs that may already contain real database credentials, then rotate any exposed password.
  7. Grant the Ghost database account only the permissions required for its designated database and restrict database network access.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (17)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

Required Helpers (Must Include)

handlebars
{{ghost_head}}     <!-- In <head> section -->
{{ghost_foot}}     <!-- Before </body> -->
{{body_class}}     <!-- Dynamic body classes -->
{{asset "path"}}   <!-- Link to theme assets -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

Common Data Helpers

handlebars
{{#post}}...{{/post}}              <!-- Post context -->
{{#foreach posts}}...{{/foreach}}  <!-- Loop posts -->
{{title}}                         <!-- Page/post title -->
{{content}}                       <!-- Post content -->
{{excerpt}}                       <!-- Post excerpt -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

handlebars
{{#post}}...{{/post}}              <!-- Post context -->
{{#foreach posts}}...{{/foreach}}  <!-- Loop posts -->
{{title}}                         <!-- Page/post title -->
{{content}}                       <!-- Post content -->
{{excerpt}}                       <!-- Post excerpt -->
{{date format="YYYY-MM-DD"}}       <!-- Format dates -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
{{#post}}...{{/post}}              <!-- Post context -->
{{#foreach posts}}...{{/foreach}}  <!-- Loop posts -->
{{title}}                         <!-- Page/post title -->
{{content}}                       <!-- Post content -->
{{excerpt}}                       <!-- Post excerpt -->
{{date format="YYYY-MM-DD"}}       <!-- Format dates -->
{{img_url feature_image}}          <!-- Image URL -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
{{#foreach posts}}...{{/foreach}}  <!-- Loop posts -->
{{title}}                         <!-- Page/post title -->
{{content}}                       <!-- Post content -->
{{excerpt}}                       <!-- Post excerpt -->
{{date format="YYYY-MM-DD"}}       <!-- Format dates -->
{{img_url feature_image}}          <!-- Image URL -->
{{url}}                           <!-- Current page URL -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
{{title}}                         <!-- Page/post title -->
{{content}}                       <!-- Post content -->
{{excerpt}}                       <!-- Post excerpt -->
{{date format="YYYY-MM-DD"}}       <!-- Format dates -->
{{img_url feature_image}}          <!-- Image URL -->
{{url}}                           <!-- Current page URL -->
{{navigation}}                    <!-- Main navigation -->

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md
- Tokens last 5 minutes
- Generate JWT tokens server-side only

**2. Staff Access Token Authentication** (For specific users)
- Each user creates their own token in settings
- Authenticates with role-based permissions
- Tokens are short-lived JWTs

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 856)May include surrounding context.

md
### Comprehensive API Documentation
- **Complete Ghost API Reference**: https://docs.ghost.org/llms-full.txt
  - Full Admin API documentation with all endpoints
  - Authentication methods (Integration tokens, Staff access tokens, User authentication)
  - Token generation examples in multiple languages (Bash, JavaScript, Ruby, Python)
  - Members API (create, update, browse)
  - Newsletters API (create, update, sender email validation)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README says the skill can be used by 'asking your OpenClaw assistant for help with Ghost CMS' and then gives 'Help me create a new Ghost theme' as an example. The phrase 'Help me' is a common everyday expression, and the document does not define a narrower invocation pattern or exclusion conditions, which could lead to unintended activation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents Admin API capabilities that include edit, add, copy, and delete operations without clearly warning that these actions can modify or remove live Ghost content. In an agent-skill context, examples are often copied verbatim, so omission of operational safety guidance increases the risk of accidental destructive changes to production instances.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

These examples perform content creation and authenticated POST requests against Ghost Admin endpoints without a prominent warning that they will change server state. In an automation setting, such examples can be executed against real environments, causing unintended posts, uploads, or administrative actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

signature=$(printf '%s' "${header_payload}" | openssl dgst -binary -sha256 -mac HMAC -macopt hexkey:$SECRET | base64_url_encode)

TOKEN="${header_payload}.${signature}" curl -H "Authorization: Ghost $TOKEN" -H "Content-Type: application/json"
-d '{"posts":[{"title":"Hello world"}]}'
"http://localhost:2368/ghost/api/admin/posts/"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.

url = 'http://localhost:2368/ghost/api/admin/posts/' headers = {'Authorization': 'Ghost {}'.format(token)} body = {'posts': [{'title': 'Hello World'}]} r = requests.post(url, json=body, headers=headers) print(r)

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 471)May include surrounding context.

md
form.append('ref', 'path/to/image.jpg');
form.append('purpose', 'image'); // 'image', 'profile_image', or 'icon'

fetch('http://localhost:2368/ghost/api/admin/images/upload/', {
  method: 'POST',
  headers: {
    'Authorization': `Ghost ${token}`,

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · SKILL.md (reported line 471)May include surrounding context.

md
form.append('ref', 'path/to/image.jpg');
form.append('purpose', 'image'); // 'image', 'profile_image', or 'icon'

fetch('http://localhost:2368/ghost/api/admin/images/upload/', {
  method: 'POST',
  headers: {
    'Authorization': `Ghost ${token}`,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The delete example normalizes an irreversible administrative action without warning about permanence or recovery constraints. In a skill used by agents, terse deletion snippets are especially risky because they lower friction for accidental destructive operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest description says the skill is a comprehensive Ghost CMS development skill covering theme development, CLI commands, API integration, and best practices, but it does not define when the skill should activate or what specific requests should trigger it. In a manifest file, this kind of broad capability description can lead to ambiguous invocation scope because there are no explicit trigger phrases, boundaries, or exclusion conditions.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:243