Balzac

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:32 AM UTC
• Version: 1.0.9

Overview

This is a coherent Balzac content-publishing CLI skill, with ordinary publishing and API-key risks that users should handle carefully.

Install this only if you trust the Balzac CLI package and account. Prefer a pinned or locally reviewed install where possible, use BALZAC_API_KEY via an environment or secret manager rather than a command argument, and review generated articles plus integration IDs before publishing or triggering webhooks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 15
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

At line 5, the skill metadata specifies an npm dependency without an exact version:

yaml

metadata: {"clawdbot":{"emoji":"✍️","requires":{"bins":["balzac"],"env":["BALZAC_API_KEY"]},"install":[{"id":"npm","kind":"npm","package":"balzac-cli","bins":["balzac"],"label":"Install Balzac CLI (npm)"}]}}

At line 15, users are instructed to install the latest available release globally:

bash

npm install -g balzac-cli

Technical Analysis

The installation instructions do not pin balzac-cli to a reviewed version or verify its integrity. Consequently, executing the documented command resolves and installs whichever release is associated with the package's current npm distribution tag.

Because the project contains only SKILL.md and does not include the dependency's source code, lockfile, integrity digest, or provenance information, the effective code executed during installation and subsequent CLI use cannot be verified from the audited artifact. npm packages can also define lifecycle scripts that execute during installation.

The use of a global installation increases exposure because the package's executable is placed in a shared command path. A compromised package release could therefore execute code during installation or provide a malicious replacement for the expected balzac command.

Attack Path

1. An attacker compromises the npm account, publication pipeline, or upstream repository associated with balzac-cli, or otherwise causes a malicious release to become the package's latest version.
2. A user follows the instruction in SKILL.md and runs npm install -g balzac-cli.
3. npm retrieves the attacker-controlled release because no exact version or integrity value is specified.
4. Malicious lifecycle code ...[truncated 1110 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version, for example:

   bash

   npm install -g balzac-cli@X.Y.Z
   

2. Document the expected official npm package owner, publisher, repository, and provenance so users can verify package authenticity.

3. Prefer a project-local installation governed by a committed lockfile instead of a global installation:

   bash

   npm install --save-exact balzac-cli@X.Y.Z
   

4. Verify the package's integrity and npm provenance before installation. Where the installation mechanism supports it, enforce a reviewed cryptographic digest.

5. Review the package's source, transitive dependencies, and lifecycle scripts before approving version updates.

6. Perform dependency updates through a controlled process that includes security scanning, reproducible validation, and explicit approval.

7. Run the CLI under a least-privileged account and provide BALZAC_API_KEY only for operations that require it. Avoid exposing unrelated credentials in the same execution environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly promotes publishing generated content to WordPress, Webflow, Wix, GoHighLevel, and webhooks, but it does not warn users that article content and related metadata will be transmitted to third-party services. In a CLI skill that automates content creation and publication, omission of data-transfer and destination warnings can lead to unintended disclosure of unpublished or sensitive business content to external platforms.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The setup instructions suggest passing the API key directly as a command-line argument (balzac auth login bz_your_key_here), which can expose credentials through shell history, terminal logs, process listings, or monitoring tools. Because this is an API key for a content publishing platform, leakage could allow unauthorized article generation, workspace access, and external publication actions at the victim's expense.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow shows balzac articles publish <id> --integration <integration-id> as a normal step without any warning that it may create or modify content on external systems and may be difficult to undo. In the context of automated publishing to CMSs and webhooks, this increases the risk of accidental publication, reputational harm, or unintended downstream automation being triggered without adequate human review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.