blog-mini-kit-ljt2

• Outcome: Review
• Latest audit: Aug 25, 2026 · 7:56 AM UTC
• Version: 0.1.0

Overview

The skill is coherent and not deceptive, but it needs review because it can make live unauthenticated changes, deletions, and uploads against a configured blog API.

Install only if you control the target blog API and understand that the skill can make real remote changes without authentication. Verify the base URL before each use, avoid uploading sensitive local files, require human confirmation for delete/upload actions, and update the requests dependency constraint before production use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions while explicitly instructing the agent to read local project files/configuration, environment variables, and make network requests to a user-supplied base URL. This mismatch hides the skill's true capabilities from any permission-review layer and increases the risk of unintended file access, secret exposure, or SSRF-style access to internal services.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad, common blog-related terms that can appear in benign conversation, making accidental invocation more likely. Because this skill supports destructive and write-capable operations against an unauthenticated public API, a false trigger could cause unintended content creation, deletion, or uploads.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill exposes file upload, delete, and other public unauthenticated write operations, but it does not present a clear, unified warning that these actions can permanently modify remote content. In this context, missing risk notice is dangerous because the API is described as publicly writable and includes irreversible delete paths and arbitrary file upload capabilities.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation exposes destructive article-management endpoints, including delete and restore behavior, while explicitly stating the API has no authentication. In this context, omission of strong warnings about deletion side effects and access control risk is dangerous because any consumer may infer these operations are safe to invoke, enabling unauthorized content deletion or tampering.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This section documents multiple destructive endpoints for comments, messages, moods, and uploaded files without warning, and the overall API is described as unauthenticated/public. In a content-management skill, that combination materially increases risk: an attacker or careless user could delete user-generated content and files at scale, causing data loss, defacement, and service disruption.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The upload commands read arbitrary local paths and transmit file contents to a remote server without any runtime disclosure or confirmation beyond the subcommand name. In an agent context, this increases the risk of accidental sensitive file exfiltration if a user or upstream prompt supplies paths like config files, keys, or local documents.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.20.0

• Confidence: 98% confidence
• Finding: The dependency is specified as `requests>=2.20.0`, which leaves resolution open to very old vulnerable versions as well as future untested releases. In a public, unauthenticated API management skill, weak dependency pinning increases supply-chain risk and makes builds non-reproducible, so insecure versions may be installed without notice.

Known Vulnerable Dependency: requests==2.20.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: Because the version specifier permits installation of `requests==2.20.0`, the project can resolve to a release with multiple known advisories. If this skill performs outbound HTTP requests as part of managing a public blog API, those flaws could expose credentials, weaken TLS/request verification behavior, or otherwise compromise integrity and confidentiality depending on runtime usage.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 82% confidence
• Finding: The trigger '博客' is extremely short and generic, so it may match routine discussion unrelated to intended API management tasks. In a skill with write/delete capabilities, accidental activation can increase the chance of unintended operations even if the trigger itself is not malicious.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 80% confidence
• Finding: The trigger '说说' is also short and conversational, making unintended matches plausible in ordinary user dialogue. Given that the skill can create and delete mood posts, accidental routing to this skill could lead to unauthorized or unintended content changes.

Static analysis

No suspicious patterns detected.