ClawHub
Back to skill

Security audit

blog-manager

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed blog administration CLI, but it can change and delete live blog data and uploads through an unauthenticated API without built-in confirmation safeguards.

Review before installing. Only use this skill with a blog API instance you control, preferably on a private network or behind authentication. Treat delete, hard-delete, user creation, and upload commands as live administrative actions, and require explicit user confirmation before running them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill advertises and documents network, shell, environment-variable, and file read/write capabilities via Python and curl, but declares no permissions or safety boundaries. This creates a transparency and governance gap: an agent may invoke a tool that can delete content, upload files, or contact arbitrary hosts without the user or platform having explicit permission metadata to constrain or review those actions.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger phrases are broad enough to match ordinary user requests about blogs rather than clear intent to use this administrative skill. That raises the risk of accidental activation, after which the skill exposes powerful API actions including creation, deletion, restoration, and file upload against a user-configured backend.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation includes destructive delete operations and file upload functionality but does not present explicit warnings, confirmation requirements, or data-impact guidance. In this context, the skill manages live blog content and uploaded files over an unauthenticated API, so accidental or coerced use could lead to permanent data loss, defacement, or unauthorized content distribution.

Missing User Warnings

High
Confidence
98% confidence
Finding
The document explicitly states the API has no authentication while exposing user management, content deletion, and file upload/delete operations. In the context of an agent skill that can invoke these endpoints, this means any caller who can trigger the skill may be able to read, create, modify, and delete sensitive or integrity-impacting resources without identity checks.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28
pytest>=7.0
Confidence
95% confidence
Finding
The dependency specifier `requests>=2.28` is unpinned, which allows different versions to be installed over time and can lead to non-reproducible builds or accidental inclusion of vulnerable releases. In this file, the risk is increased because the static analysis also indicates `requests` 2.28 itself has known advisories, so allowing a broad range without an upper bound or lockfile weakens supply-chain control.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28
pytest>=7.0
Confidence
89% confidence
Finding
The dependency specifier `pytest>=7.0` is unpinned, so installations may resolve to different versions depending on time and environment, undermining reproducibility and supply-chain assurance. Although `pytest` is typically a development dependency, the finding is still relevant because the analyzer reports known vulnerable 7.0-series versions and unbounded ranges make version governance weak.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
响应：`{code: 200, message: "..."}`

### DELETE /api/articles/{article_id}

删除文章（支持软删除）。
Confidence
96% confidence
Finding
A delete-article endpoint identified only by a path parameter is dangerous in this skill because the same file states the API is unauthenticated. That combination enables unauthorized deletion or abuse through arbitrary article_id selection, causing content loss or defacement at scale.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
响应：`{code: 200, data: [{id, uname, content, createtime}, ...]}`

### DELETE /api/comments/{comment_id}

删除评论。
Confidence
95% confidence
Finding
The delete-comment operation can be abused by supplying arbitrary comment IDs, and the broader API context indicates no authentication. This permits unauthorized censorship, integrity loss, and possible bulk deletion of discussion content.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
响应：`{code: 200, data: {id}}`

### DELETE /api/messages/{message_id}

删除留言。
Confidence
95% confidence
Finding
The delete-message endpoint allows destructive action based solely on a message_id parameter, and the documented lack of authentication makes misuse straightforward. Attackers could remove guestbook or message-board data, harming integrity and trust in the system.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
响应：`{code: 200, data: {id}}`

### DELETE /api/moods/{mood_id}

删除说说。
Confidence
94% confidence
Finding
Deleting moods/posts by ID is a sensitive operation, and in an unauthenticated API it permits arbitrary content removal. The impact is somewhat narrower than user/file operations but still enables unauthorized tampering and loss of site content.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
响应：`{code: 200, data: [{filename, url, type, size}, ...]}`

### DELETE /api/uploads/{filename}

删除已上传文件。
Confidence
99% confidence
Finding
Deleting uploaded files by filename is especially dangerous because it affects stored assets directly, and the API is documented as unauthenticated. An attacker could remove site media or potentially target crafted filenames if backend normalization is weak, resulting in severe integrity and availability impact.

Static analysis

No suspicious patterns detected.