blog-kimi-test-kit

• Outcome: Review
• Latest audit: Sep 1, 2026 · 1:25 PM UTC
• Version: 0.1.1

Overview

The skill is a disclosed blog API management tool, but it exposes unauthenticated write, upload, user creation, and bulk-delete actions without clear safety gates.

Install only for a controlled test or private blog API that you are authorized to manage. Before production use, add authentication/authorization, narrow the triggers, require explicit confirmation for delete/upload/admin actions, add dry-run or preview behavior for bulk deletion, and restrict uploads to intended files/directories.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to read environment variables and project files, then make network requests, but it declares no explicit permissions boundary. That mismatch matters because the skill can access local configuration and external systems without a clear least-privilege contract, increasing the chance of unintended data access or execution in broader contexts.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill is described as a blog content publishing tool, but the API reference exposes user creation endpoints without any authentication or role constraints. In this context, account management expands the tool’s authority beyond content publishing and could enable unauthorized account provisioning or abuse if an agent invokes it directly.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The documented admin bulk-delete endpoint grants elevated destructive capability that exceeds normal blog publishing operations, and the file states the API is unauthenticated. This creates a high-risk path for mass content deletion by an agent, user mistake, or malicious prompt injection if the skill is exposed.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill is presented as a blog content publishing tool, but it also advertises user-management capability including listing and creating users. That expands the privilege surface beyond content operations and can enable account enumeration or unauthorized account creation against a public API.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code implements user enumeration and user creation operations even though the tool's stated purpose is blog publishing. In a public unauthenticated API context, these capabilities can facilitate account discovery, spam account creation, and lateral misuse beyond normal content management.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill includes an admin bulk-deletion endpoint that is not aligned with a normal content publishing client and is especially risky because the tool declares no authentication. This creates a highly destructive capability that could be invoked accidentally or abused to remove large amounts of content if the server accepts the request.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation states the API is public and unauthenticated while the code targets an /admin endpoint. That mismatch can mislead operators into thinking all actions are low-risk and normalizes invoking privileged functionality without proper safeguards.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrases are extremely broad generic words such as '博客', '文章', and 'content', which can cause accidental invocation during normal conversation. In a skill that can create, delete, upload, and administer remote resources, unintended activation meaningfully raises the risk of unauthorized or surprising side effects.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill advertises management of files and destructive resource operations but does not pair those capabilities with clear user-facing warnings, confirmation requirements, or safety gates. That is dangerous because users may invoke actions with deletion or upload consequences without understanding the scope or permanence of the operation.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The documented `admin-delete-articles` capability enables bulk deletion and is presented without an explicit caution, approval workflow, or confirmation barrier. Because bulk deletion can cause large-scale irreversible content loss, especially in an unauthenticated public API context, this materially increases the chance of catastrophic accidental or unauthorized destruction.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The reference explicitly says the base URL has no authentication and then lists multiple write and delete endpoints for articles, comments, messages, moods, uploads, users, and admin deletion without any warning or restriction. Unauthenticated destructive and state-changing operations are a severe security flaw because anyone who can reach the service may modify or delete content and potentially abuse file-upload functionality.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The upload commands read arbitrary local files and transmit them to the configured remote API, but the tool provides no explicit warning at execution time about exfiltrating local data. In an agent-skill setting, this is risky because a user may not realize that local filesystem content will be sent off-host.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Destructive delete actions execute immediately with no confirmation, preview, or safety interlock. In a CLI or agent context, this increases the chance of accidental data loss and makes prompt-injection-driven misuse more damaging.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The admin bulk deletion command is a high-impact destructive action with no confirmation or warning. Because it can affect many articles at once, the lack of friction substantially raises the risk of catastrophic accidental or malicious content removal.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.20.0

• Confidence: 96% confidence
• Finding: The dependency is specified as `requests>=2.20.0`, which is unpinned and permits installation of a wide range of versions depending on resolver behavior and environment state. This undermines reproducibility and can allow deployment of unexpectedly outdated or vulnerable versions, which is especially risky for a skill that manages blog REST APIs and likely performs authenticated HTTP requests.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 86% confidence
• Finding: The trigger '博客' is so short and generic that it can match routine discussion rather than an intentional request to run this skill. Since the skill can perform remote mutations, even low-probability accidental activation is a real safety issue.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 86% confidence
• Finding: The trigger '文章' is a common conversational term and can unintentionally activate the skill during ordinary requests about writing or editing text. In a skill with create/update/delete capabilities, generic triggers create avoidable invocation risk.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 85% confidence
• Finding: The trigger '标签' is overly generic and may collide with unrelated conversations about labels or tags. Such ambiguous routing is unsafe for a skill capable of modifying remote resources.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 85% confidence
• Finding: The trigger '评论' is broad enough to match normal requests about comments, reviews, or discussion rather than a request to invoke a blog API tool. This increases accidental invocation risk for a mutation-capable skill.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 84% confidence
• Finding: The trigger '留言' is short and ambiguous, so it may activate the skill for ordinary discussion about messages or guestbook content. Generic trigger collisions are risky when the skill can create or delete data remotely.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 83% confidence
• Finding: The trigger '说说' is still a short generic term that may be mentioned conversationally without intending to invoke tooling. Even if lower-frequency than other terms, it remains an unnecessary routing risk for a destructive-capable skill.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

upload-file            — POST /api/upload, upload single file
  upload-files           — POST /api/upload/multiple, upload multiple files
  list-uploads           — GET /api/uploads/list, list uploads
  delete-upload          — DELETE /api/uploads/{filename}, delete upload
  admin-delete-articles  — POST /admin/api/delete, admin delete articles

Authentication: none (public API)

• Confidence: 83% confidence
• Finding: Deleting uploads by arbitrary filename is more dangerous than numeric ID deletion because filenames can map directly to stored assets and may be easier to abuse if the backend performs weak path handling or authorization. In an unauthenticated public-API context, exposing direct file-deletion capability materially raises the risk of asset removal or backend path-manipulation abuse if the server is flawed.

Static analysis

No suspicious patterns detected.