blog-big-kimi-kit

• Outcome: Review
• Latest audit: Aug 31, 2026 · 2:19 PM UTC
• Version: 1.0.1

Overview

This skill is not clearly malicious, but it gives an agent broad unauthenticated power to publish, delete, create users, and upload local files to a configured blog API without built-in confirmations.

Install only if you intend to give the agent administrative control over the target blog API. Use it with a trusted base URL, avoid exposing the API publicly without server-side authorization, confirm every create/update/delete/upload action yourself, and do not ask it to upload files unless you have checked the exact path and destination. Pin requests to a current patched version before production use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (19)

Tainted flow: 'files' from open (line 443, file read) → requests.post (network output)

High

• Category: Data Flow

Content

if method == 'GET':
            resp = requests.get(url, params=params, timeout=30, **auth_kwargs)
        elif method == 'POST':
            resp = requests.post(url, json=payload, files=files, timeout=30, **auth_kwargs)
        elif method == 'PUT':
            resp = requests.put(url, json=payload, files=files, timeout=30, **auth_kwargs)
        elif method == 'PATCH':

• Confidence: 88% confidence
• Finding: The skill reads arbitrary local files specified by --filepath/--filepaths and transmits their contents to a remote URL controlled by BLOG_BIG_KIMI_KIT_BASE_URL or interactive user input. In an agent context, this creates a clear exfiltration primitive: a prompt or indirect instruction could cause sensitive local files to be uploaded off-host.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill explicitly instructs reading configuration from `.project-info/` and environment variables, and performing network calls via curl/Python, but declares no permissions/capability boundaries in the manifest. This creates a transparency and policy-enforcement gap: operators may approve the skill as low-risk while it can still read local files and exfiltrate values to remote endpoints.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The skill is presented as a blog content publishing tool, but its documented scope includes user-management operations. That broader authority can mislead users and reviewers about the actual blast radius, enabling account creation or enumeration under the guise of content operations.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: User creation is not necessary for a typical content-publishing workflow and materially expands the skill from content management into identity administration. If invoked carelessly, it could create unauthorized accounts or seed weak/default credentials in a public API.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: Arbitrary file upload and deletion are significantly more dangerous than ordinary blog publishing because they can be abused to store unwanted content, overwrite business workflows, or delete assets. In the context of a public unauthenticated API, these endpoints increase the chance of destructive or abusive actions being executed without meaningful safeguards.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The skill is presented as a blog content publishing tool but also includes full user-management capability such as listing and creating users. This scope mismatch increases the chance that an agent or operator will invoke sensitive account-management actions without realizing the skill exceeds its stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: User creation is a privileged administrative action that is not justified by the stated purpose of blog content publishing. In an agent setting, this can enable unauthorized account provisioning or persistence on the target system if the skill is invoked by untrusted prompts or loosely supervised workflows.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation includes create, update, delete, restore, upload, and reply actions but does not require a clear user warning or confirmation before mutating remote state. That increases the risk of accidental destructive actions, especially because some operations affect public content, files, users, comments, and messages.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document exposes numerous state-changing and destructive endpoints, including create, update, delete, restore, reply, user creation, and file upload/delete operations, while explicitly stating the API is public and unauthenticated. In a skill meant for content publishing and management, this can lead an agent or user to perform irreversible or unauthorized modifications without any warning, confirmation, or safety guidance.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The upload commands transmit local file contents to an external service without any user-facing disclosure, confirmation, or restriction. Because file paths are agent-controlled arguments, this can lead to accidental or induced leakage of secrets, source code, credentials, or other sensitive local artifacts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill exposes destructive delete operations with no confirmation, dry-run mode, or safety interlock. In an agentic workflow, accidental invocation, prompt injection, or parameter confusion could irreversibly remove articles or other content from the remote system.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.20.0

• Confidence: 97% confidence
• Finding: The dependency is specified as `requests>=2.20.0`, which is unpinned and permits installation of many different versions depending on resolver behavior and environment state. This weakens supply-chain control and reproducibility, and it also allows an unsafe minimum version that includes releases with known security issues.

Known Vulnerable Dependency: requests==2.20.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: The requirement allows `requests==2.20.0`, a version with multiple published advisories. If the environment resolves to that version, the skill may inherit issues such as credential leakage, TLS/session verification weaknesses, or other request-handling flaws, which is especially concerning for a blog management skill likely to interact with authenticated HTTP APIs and file upload endpoints.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

1. **API 路径拼写 lables**。标签端点实际路径为 `/api/lables`（非 `labels`），子命令用正确拼写 `labels`，脚本内部请求时用实际路径 `lables`。
2. **文章详情返回嵌套结构**。`GET /api/articles/{id}` 返回 `{"code":200,"data":{"article":{...},"comments":[...]}}`，article 和 comments 是嵌套字段。
3. **文章删除默认软删除**。`DELETE /api/articles/{id}` 默认 `soft=true`，需用 `restore-article` 恢复。传 `--soft false` 硬删除。
4. **文件上传用 multipart/form-data**。`POST /api/upload` 字段名 `file`，`/api/upload/multiple` 字段名 `files`，不是 JSON body。脚本用 `files=` 参数传递。
5. **分页参数 page/size**。`GET /api/articles` 支持 `page`（默认1）、`size`（默认10，最大100）、`lid`（标签筛选，默认0=不限）、`keyword`（关键词搜索）。
6. **说说创建 content 必填**。`POST /api/moods` 的 `content` 字段必填，`title` 和 `src` 可选。

• Confidence: 90% confidence
• Finding: The skill exposes destructive API parameters such as article deletion with `--soft false`, enabling hard deletion through tool arguments. Without strong validation and confirmation, parameterized destructive operations are susceptible to misuse, prompt-induced abuse, or accidental irreversible data loss.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def cmd_delete_article(args):
    """能力 F：删除文章（支持软删除）"""
    # DELETE /api/articles/{article_id}
    params = {}
    if args.soft is not None:
        params['soft'] = args.soft

• Confidence: 91% confidence
• Finding: The delete-article command directly maps user-supplied parameters to a destructive remote API call with no authorization guard, confirmation, or policy validation in the skill. In agent use, this makes prompt-driven deletion of content straightforward and raises the risk of abuse or accidental loss.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def cmd_delete_comment(args):
    """能力 O：删除评论"""
    # DELETE /api/comments/{comment_id}
    result = _api_request('DELETE', f'/api/comments/{args.comment_id}')
    return result

• Confidence: 90% confidence
• Finding: The delete-comment command allows arbitrary comment IDs to be deleted through direct parameterization. Without additional checks in the skill, an agent can be induced to remove user-generated content unexpectedly or at scale.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def cmd_delete_message(args):
    """能力 S：删除留言"""
    # DELETE /api/messages/{message_id}
    result = _api_request('DELETE', f'/api/messages/{args.message_id}')
    return result

• Confidence: 90% confidence
• Finding: The delete-message capability directly forwards a chosen message ID into a destructive API call. This makes the skill susceptible to misuse for unauthorized moderation or deletion when driven by untrusted instructions.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def cmd_delete_mood(args):
    """能力 V：删除说说"""
    # DELETE /api/moods/{mood_id}
    result = _api_request('DELETE', f'/api/moods/{args.mood_id}')
    return result

• Confidence: 89% confidence
• Finding: The delete-mood action is another destructive endpoint with no in-skill safety checks. In the context of an agent, this can be triggered by malicious or mistaken prompts, causing content loss on the connected blog service.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def cmd_delete_upload(args):
    """能力 Z：删除已上传文件"""
    # DELETE /api/uploads/{filename}
    result = _api_request('DELETE', f'/api/uploads/{args.filename}')
    return result

• Confidence: 92% confidence
• Finding: The delete-upload command accepts an arbitrary filename and sends it to a remote delete endpoint with no validation or confirmation. Given this skill also manages uploads, an attacker could combine upload/list/delete flows to tamper with stored files or remove important assets through prompt-driven tool abuse.

Static analysis

No suspicious patterns detected.