ClawHub
Back to skill

Security audit

Ecto

Security checks for vulnerabilities and agentic risk

Overview

This Ghost admin CLI is mostly coherent, but it gives an agent broad live-site authority and stores admin credentials without enough warning or scoping.

Review this before installing if you will connect it to a production Ghost site. Treat the Admin API key as a powerful secret, avoid pasting it into shared prompts or logs, consider using a staging site first, verify the selected --site before write operations, and be careful with publish, delete, schedule, image upload, and webhook commands because they can change public content or leave persistent integrations behind.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
cmd/auth.go:19
Finding

Admin API Key Exposed Through Command-Line Arguments and Plaintext Configuration Storage

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
README.md:8
Finding

Installation Instructions Use an Unpinned Mutable Dependency Source

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (24)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill description focuses on posts, pages, tags, and content management, but the documented commands also expose user and newsletter information through users, user, newsletters, and newsletter. Undisclosed access to user profile data broadens the sensitivity of the skill and may lead to unanticipated disclosure of personal or administrative information.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill description focuses on posts, pages, tags, and content management, but the documented commands also expose user and newsletter information through users, user, newsletters, and newsletter. Undisclosed access to user profile data broadens the sensitivity of the skill and may lead to unanticipated disclosure of personal or administrative information.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · cmd/testutil_test.go (reported line 27)May include surrounding context.

go
w.Header().Set("Content-Type", "application/json")
		path := r.URL.Path

		// Remove /ghost/api/admin prefix
		apiPath := strings.TrimPrefix(path, "/ghost/api/admin")

		// Helper to check if path is exactly /resource/ (list endpoint)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README shows Admin API keys and environment variables without clearly warning that they are sensitive secrets. In an AI-agent or copy-paste workflow, this increases the chance that users expose credentials in shell history, logs, screenshots, transcripts, or shared config, which could enable full administrative access to a Ghost site.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file describes commands that can delete posts/pages/tags, publish or unpublish content, and create/delete webhooks that affect a production Ghost site. The README presents these operations as routine usage but does not include any caution about irreversible changes, live-site impact, or verifying the target site before running them.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 164)May include surrounding context.

Pipe content from stdin

bash
echo "# Quick Note" | ecto post create --title "Quick Note" --stdin-format markdown

Schedule a post

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents capabilities that use environment variables for secrets and appears to support actions that can modify remote Ghost content, but it declares no explicit tool scope or permissions. In an agent setting, missing scope boundaries increases the chance of over-broad execution and makes it harder for users or orchestrators to understand that the skill can access sensitive configuration and perform write operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The authentication section instructs users to provide Ghost Admin API keys directly on the command line and via environment variables, but it gives no warning about secret exposure. Command-line arguments can leak through shell history or process inspection, and environment-based secrets can be mishandled or logged by surrounding automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill advertises destructive and state-changing commands such as delete, publish, unpublish, and schedule without warning that they immediately alter remote Ghost content. In an agent-driven workflow, lack of explicit warnings or confirmation patterns increases the risk of accidental production changes and content loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

Page, tag, and webhook deletion operations are documented as routine commands without highlighting that they perform destructive remote changes. This is risky because users or autonomous agents may invoke them without appreciating the operational impact on site behavior, taxonomy, or integrations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code file handles a sensitive credential via the --key flag, and the command flow persists it through cfg.AddSite without any user-facing warning about storing or handling the secret. While the command prints success messages, there is no disclosure that a credential is being saved or that it may end up in local configuration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code deletes posts and only presents a confirmation prompt when --force is not set. When --force is used, the destructive action proceeds immediately and there is no comment, docstring, or other user-facing warning in this file explaining that the flag suppresses confirmation for permanent deletion.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a Ghost Admin API CLI for managing blog posts, pages, tags, and content, but this test file exercises a users command path and expects No users found output. That suggests the implemented skill includes user-management functionality beyond the stated manifest scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This Go file includes markdown-style help content, so SQP-2 applies. The help shows a plaintext config example containing an api_key and identifies GHOST_ADMIN_KEY as an environment variable, but it does not warn users that these credentials are sensitive and should be protected from disclosure or insecure storage.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · cmd/root.go (reported line 173)May include surrounding context.

go
## Error Handling
- Returns non-zero exit code on errors
- Error messages include API error details when available
- Use --force to skip confirmation prompts on destructive operations

## Limitations
- Ghost API does not support listing images or webhooks

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest describes a Ghost.io Admin API CLI for managing blog posts, pages, tags, and content. This test file demonstrates implemented support for additional Admin API areas including users, site metadata, settings, newsletters, webhooks, and image uploads, which expands the effective behavior beyond the stated description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest describes the skill as a Ghost.io Admin API CLI for managing blog posts, pages, tags, and content, which does not mention webhook administration. This file adds create and delete operations for webhooks, introducing a distinct administrative capability beyond the stated scope.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · cmd/pages.go (reported line 249)May include surrounding context.

go
webhookCreateCmd.Flags().String("target-url", "", "Target URL for webhook")
	webhookCreateCmd.Flags().String("name", "", "Webhook name (optional)")

	webhookDeleteCmd.Flags().Bool("force", false, "Delete without confirmation")

	webhookCmd.AddCommand(webhookCreateCmd)
	webhookCmd.AddCommand(webhookDeleteCmd)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · cmd/posts.go (reported line 338)May include surrounding context.

go
webhookCreateCmd.Flags().String("target-url", "", "Target URL for webhook")
	webhookCreateCmd.Flags().String("name", "", "Webhook name (optional)")

	webhookDeleteCmd.Flags().Bool("force", false, "Delete without confirmation")

	webhookCmd.AddCommand(webhookCreateCmd)
	webhookCmd.AddCommand(webhookDeleteCmd)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · cmd/tags.go (reported line 185)May include surrounding context.

go
webhookCreateCmd.Flags().String("target-url", "", "Target URL for webhook")
	webhookCreateCmd.Flags().String("name", "", "Webhook name (optional)")

	webhookDeleteCmd.Flags().Bool("force", false, "Delete without confirmation")

	webhookCmd.AddCommand(webhookCreateCmd)
	webhookCmd.AddCommand(webhookDeleteCmd)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · cmd/webhooks.go (reported line 86)May include surrounding context.

go
webhookCreateCmd.Flags().String("target-url", "", "Target URL for webhook")
	webhookCreateCmd.Flags().String("name", "", "Webhook name (optional)")

	webhookDeleteCmd.Flags().Bool("force", false, "Delete without confirmation")

	webhookCmd.AddCommand(webhookCreateCmd)
	webhookCmd.AddCommand(webhookDeleteCmd)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes this CLI as managing blog posts, pages, tags, and content, but this test file exercises webhook creation and deletion commands. Webhook administration is a distinct Ghost Admin API capability not mentioned in the declared skill description, indicating the implemented feature set is broader than advertised.

Content

No source excerpt is available for this finding.

Ssd 3

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The example includes a realistic-looking id:secret API key format that could be copied, reused, or echoed by AI agents as if it were valid credential material. Even if the value is fictitious, realistic secret-shaped examples normalize unsafe handling and can confuse users about what should be treated as sensitive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The remove command deletes a stored site configuration and only reports the action after it has completed. There is no confirmation prompt, pre-action warning, or explanatory comment indicating that configuration data will be removed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.