ClawHub
Back to skill

Security audit

blog-manager-kit

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real blog-management tool, but it can change or delete public blog content and upload local files to an unauthenticated HTTP service with too little scoping or confirmation.

Install only if you control the target Blog System API and are comfortable with an unauthenticated management client. Set `BLOG_MANAGER_KIT_BASE_URL` explicitly rather than relying on the built-in HTTP default, avoid passing passwords on the command line, and treat upload and delete commands as sensitive actions requiring explicit review. Be aware that the skill tells agents to write Issue/PR comments after operations, which may expose results outside the blog system.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (17)

Tainted flow: 'files' from open (line 360, file read) → requests.post (network output)

High
Category
Data Flow
Content
if method == 'GET':
            resp = requests.get(url, params=params, timeout=30, **auth_kwargs)
        elif method == 'POST':
            resp = requests.post(url, json=payload, files=files, timeout=30, **auth_kwargs)
        elif method == 'PUT':
            resp = requests.put(url, json=payload, files=files, timeout=30, **auth_kwargs)
        elif method == 'PATCH':
Confidence
95% confidence
Finding
resp = requests.post(url, json=payload, files=files, timeout=30, **auth_kwargs)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill declares powerful capabilities in practice—reading project files/config, environment variables, and making arbitrary network calls—yet does not declare permissions explicitly. That mismatch weakens policy enforcement and user awareness, especially because the skill also performs write/delete operations against a remote API and reads `.project-info/` for configuration.

Intent-Code Divergence

Medium
Confidence
81% confidence
Finding
The mandatory Issue/PR comment format is unrelated to the stated blog API management purpose, creating a hidden side effect channel not aligned with the declared capability set. In practice this can cause agents to post user content or operation results into unrelated repositories or collaboration systems, leaking data beyond the intended blog API target.

Intent-Code Divergence

High
Confidence
94% confidence
Finding
The instruction that the agent 'must' publish an Issue comment after every operation introduces an undeclared outbound action that is outside the blog-management scope. Because the skill is unauthenticated and broadly triggered, this side effect can exfiltrate API results, user-provided text, and operational metadata into external systems without explicit user intent.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill provides direct arbitrary local file read capability through --file/--files and immediately transmits the bytes to the remote server. For an agent skill, this exceeds ordinary blog CRUD functionality and materially increases the risk of sensitive local data disclosure.

Vague Triggers

Medium
Confidence
90% confidence
Finding
Triggers like `blog`, `article`, and `blog api` are overly broad and likely to activate on ordinary conversation rather than an explicit request to run a management tool. In a skill that can create, update, delete content and upload/remove files on a remote service, accidental invocation materially increases the chance of unintended destructive actions.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill exposes multiple destructive operations—deleting comments, messages, moods, uploads, and soft-deleting articles—but only documents a confirmation safeguard for hard-delete article. In a no-auth public API context, lack of consistent confirmation makes accidental or prompt-induced destructive changes much easier and more damaging.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The document advertises a management API that performs creation, deletion, restoration, file upload, and user/comment/message operations while explicitly stating there is no authentication. In this skill context, that is not merely missing cautionary text in documentation—the underlying capability enables unauthenticated destructive actions and access to user/content data, making misuse trivial for any caller who can reach the service.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The upload operations send local file contents over the network without a conspicuous user-facing warning at invocation time. In an agent context, silent outbound transfer of local files can mislead users and enable unintended disclosure.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The create-user command accepts a password parameter and sends it to the API, but the skill gives no caution about handling sensitive secrets and defaults to plain HTTP for the remote endpoint. This creates unnecessary exposure of credentials in transit and via command-line history/process inspection.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.20.0
Confidence
93% confidence
Finding
requests>=2.20.0

Tool Parameter Abuse

High
Category
Tool Misuse
Content
def cmd_delete_article(args):
    """能力 F：删除文章（软删除，可恢复）。"""
    # DELETE /api/articles/{article_id}?soft=true
    return _api_request('DELETE', f'/api/articles/{args.article_id}',
                        params={'soft': True})
Confidence
89% confidence
Finding
DELETE /api/articles/{article_id}?soft=true

Tool Parameter Abuse

High
Category
Tool Misuse
Content
def cmd_hard_delete_article(args):
    """能力 G：硬删除文章（不可逆，需二次确认）。"""
    # DELETE /api/articles/{article_id}?soft=false
    if not args.yes:
        print("⚠️  警告：硬删除不可逆，文章将被永久删除且无法恢复！", file=sys.stderr)
        print(f"     目标文章 ID：{args.article_id}", file=sys.stderr)
Confidence
97% confidence
Finding
DELETE /api/articles/{article_id}?soft=false

Tool Parameter Abuse

High
Category
Tool Misuse
Content
def cmd_delete_comment(args):
    """能力 P：删除评论（软删除）。"""
    # DELETE /api/comments/{comment_id}
    return _api_request('DELETE', f'/api/comments/{args.comment_id}')
Confidence
88% confidence
Finding
DELETE /api/comments/{comment_id}

Tool Parameter Abuse

High
Category
Tool Misuse
Content
def cmd_delete_message(args):
    """能力 T：删除留言（软删除）。"""
    # DELETE /api/messages/{message_id}
    return _api_request('DELETE', f'/api/messages/{args.message_id}')
Confidence
88% confidence
Finding
DELETE /api/messages/{message_id}

Tool Parameter Abuse

High
Category
Tool Misuse
Content
def cmd_delete_mood(args):
    """能力 W：删除说说。"""
    # DELETE /api/moods/{mood_id}
    return _api_request('DELETE', f'/api/moods/{args.mood_id}')
Confidence
88% confidence
Finding
DELETE /api/moods/{mood_id}

Tool Parameter Abuse

High
Category
Tool Misuse
Content
def cmd_delete_upload(args):
    """能力 AA：删除已上传文件。"""
    # DELETE /api/uploads/{filename}
    return _api_request('DELETE', f'/api/uploads/{args.filename}')
Confidence
92% confidence
Finding
DELETE /api/uploads/{filename}

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.