Security audit

blog-mini-kit-liufei

Security checks for vulnerabilities and agentic risk

Overview

This blog-management skill is mostly transparent, but it can publish, upload, and delete live blog content, including hard and bulk deletes, without strong user confirmation safeguards.

Install only if you intend to let the agent manage a real FastAPI blog. Confirm the base URL is trusted, change any default admin credentials, avoid giving admin tokens unless needed, and require explicit human confirmation before uploads, hard deletes, file deletes, or admin bulk deletion.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares no permissions while explicitly instructing access to environment variables, local project files under `.project-info/`, and remote network endpoints via curl/python scripts. This permission/behavior mismatch can cause the agent or reviewer to underestimate the skill’s effective capabilities, especially since it can reach configuration data and perform external API calls.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description says the system is '无认证' (no authentication), but the skill also includes `admin-login` and privileged admin deletion flows. That mismatch is security-relevant because it can mislead users and downstream tooling into treating the skill as limited to public unauthenticated APIs when it actually supports privileged operations.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The document simultaneously claims 'no authentication' and later prescribes token-based admin access with default credentials. This internal contradiction obscures the real trust model and increases the chance that privileged actions are invoked casually or without proper scrutiny.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Embedding default administrator credentials (`admin/admin`) and pairing them with bulk-delete capability normalizes access to privileged administrative functions. In context, this is more dangerous because the skill is framed as a general blog-management helper, so users may trigger destructive admin behavior beyond ordinary content operations.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The reference states the API has no authentication and is public, but later documents admin login and token-based admin operations. This inconsistency can mislead agents or users into treating privileged endpoints as safe/public, increasing the chance of unauthorized or risky admin actions.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: Claiming '公开 API' while later including authenticated admin endpoints creates security-boundary confusion. In an agent skill, this can cause unsafe automation behavior such as attempting login flows, handling admin tokens insecurely, or exposing privileged operations as if they were ordinary content APIs.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill metadata and comments repeatedly frame the API as 'no authentication', but the code also includes `admin-login` and token-based administrative deletion operations. That mismatch can mislead operators and downstream automation about the sensitivity of the actions exposed, increasing the chance that privileged or destructive functions are invoked without appropriate safeguards.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: Broad triggers like '博客管理' and '博客系统' can cause the skill to activate in loosely related contexts, increasing the risk of unintended execution of high-impact operations such as delete, upload, or admin flows. Given this skill includes destructive and privileged capabilities, overbroad activation is more dangerous than it would be for a read-only skill.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill advertises deletion, bulk deletion, and file upload capabilities without clear user-facing warnings, confirmation requirements, or discussion of irreversible effects. In this context, those are high-impact actions against a live content system, so lack of warnings materially raises misuse risk.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The delete-article documentation includes both soft delete and irreversible hard delete but does not warn about permanence or operational risk. In a no-auth/publicly documented API context, omission of a warning makes accidental destructive use more likely, especially by automated agents following examples literally.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The admin batch-delete endpoint can remove multiple articles in one request, yet the documentation does not prominently warn about the scale of impact. Because it is an administrative bulk operation, misuse can cause rapid, large-scale content loss.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The file deletion endpoint is documented as a routine operation without warning that it permanently removes uploaded assets. This increases the risk of accidental data loss and broken content references, particularly in an agent setting where file operations may be executed automatically.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The article deletion command performs destructive operations immediately, including hard delete when `--hard` is used, without a confirmation prompt or explicit runtime warning. In a blog-management skill, this materially raises the risk of accidental or automated content loss, especially because the tool also targets unauthenticated endpoints.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Comment deletion is executed without confirmation, making accidental removal easy in interactive or automated use. Although narrower in scope than article or admin deletion, it can still cause integrity loss and moderation mistakes on a live blog.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Message deletion happens immediately without any runtime warning or acknowledgement from the operator. In this context, that can silently remove user-generated content and is particularly risky if the skill is used by automation or with copied command snippets.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Mood deletion is another destructive action issued without confirmation or warning. Even if the affected content is less critical than articles, the pattern shows unsafe defaults for content-destruction operations across the skill.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The upload command reads a local file and sends it to a remote server without any in-code warning, confirmation, or trust check on the destination. In a skill that asks the user for an arbitrary base URL, this increases the risk of accidental disclosure of sensitive local files to an untrusted endpoint.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Batch upload amplifies the single-file disclosure risk by transmitting multiple local files in one action, again without explicit warning or confirmation. Because the tool can be pointed at any operator-provided base URL, a mistake or maliciously suggested endpoint could lead to significant unintended data exposure.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Uploaded-file deletion is performed immediately without confirmation, which can cause avoidable data loss on the remote system. Since file management actions are often irreversible or hard to audit, the lack of safeguards makes the skill operationally unsafe.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Administrative bulk deletion allows removal of multiple articles in a single request without any confirmation or runtime warning. In context, this is especially dangerous because the skill already blurs public and privileged operations, so an operator may underestimate the impact and trigger large-scale destructive changes.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.20.0
Confidence: 97% confidence
Finding: The dependency is specified as `requests>=2.20.0`, which is unpinned and allows installation of a wide range of versions depending on resolver behavior and environment state. This weakens reproducibility and can permit an outdated or vulnerable version to be installed, especially in a skill that manages a networked FastAPI blog system and likely performs HTTP requests.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: 1. **API 不可达。** 先 `curl {base_url}/health` 确认可达，检查 base_url 是否正确。 2. **标签路径拼写为 lables（非 labels）。** API 实际路径是 `/api/lables`，子命令用正确拼写 `create-lable` 但内部请求用 `/api/lables`。 3. **DELETE /api/articles/{id} 默认软删除。** 需要硬删除时传 `soft=false`（子命令用 `--hard` 标志）。 4. **文件上传必须用 multipart/form-data。** curl 用 `-F "file=@path"`，不能用 `-d` JSON。 5. **后台管理需 token。** 先调 `admin-login` 获取 token，再传给 `admin-delete-articles --token`。 6. **GET /api/articles/heat/top 路径冲突。** FastAPI 路由匹配 `/api/articles/heat/top` 优先于 `/api/articles/{id}`，无需担心 ID 被解析为 "heat"。
Confidence: 92% confidence
Finding: The skill exposes direct destructive operations, including article deletion and hard-delete behavior, with operational tips that make invoking them straightforward. In the broader skill context, this is riskier because the same document also supports admin login and bulk deletion, so a mis-triggered or poorly reviewed command could cause data loss at scale.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:363