blog-mini-kit-mys

• Outcome: Review
• Latest audit: Aug 25, 2026 · 3:31 AM UTC
• Version: 1.0.0

Overview

This is a disclosed blog-management skill, but it can create, upload, and delete live public content with weak safeguards, so it needs review before installation.

Install only for a blog system you own or are authorized to administer. Set the base URL explicitly, avoid default admin credentials, do not store unnecessary prefixed secrets in .project-info or the environment, and require manual review before upload, delete, hard-delete, user creation, or admin bulk deletion actions. Pin requests to a current vetted version before use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Tainted flow: 'base_url' from input (line 141, user input) → requests.post (network output)

Medium

• Category: Data Flow

Content

import requests
    base_url = _get_base_url()
    try:
        resp = requests.post(f"{base_url}/admin/login",
                             data={'username': args.username, 'password': args.password},
                             allow_redirects=False, timeout=30)
    except requests.exceptions.RequestException as e:

• Confidence: 89% confidence
• Finding: The base URL is sourced from project files, environment variables, or interactive user input and is used directly to send admin credentials to /admin/login. This can enable SSRF-like behavior or credential exfiltration to an attacker-controlled endpoint if the base URL is tampered with, which is especially sensitive because the function explicitly transmits username and password.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to read local configuration files and environment variables, then make network requests, but it does not declare corresponding permissions or trust boundaries. This creates a capability mismatch where sensitive local data such as internal base URLs or secrets in .project-info may be accessed implicitly and sent to a remote service without explicit user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill advertises itself as a no-auth public API client, yet it recursively scans .project-info and environment variables for usernames, passwords, tokens, API keys, and base URLs. Even though it filters by a prefix, this is still secret harvesting behavior that expands the skill's access to local sensitive data beyond what is necessary for a public API tool.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The code declares authentication as none while still implementing logic to load usernames, passwords, tokens, and API keys. This mismatch is dangerous because it hides secret-access behavior from users and reviewers, undermining informed consent and making secret exposure or misuse more likely.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger phrases are broad enough to activate on many ordinary blog-related requests, increasing the chance the skill runs in contexts the user did not intend. Because the skill can perform write and delete operations against a live unauthenticated API, accidental activation can lead directly to unwanted state changes.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill exposes destructive capabilities including delete, bulk delete, and irreversible file or content removal, but the description and workflow do not consistently require a confirmation step before execution. In this context, the risk is elevated because the API is described as unauthenticated for many endpoints, so a mistaken or rushed invocation can immediately cause data loss.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation exposes a destructive DELETE endpoint for comments and explicitly notes that it is not recoverable, but it provides no warning, confirmation guidance, authorization expectations, or operational safeguards. In the broader skill context, this is more dangerous because the entire blog API is described as unauthenticated/public, so an agent or user could invoke comment deletion directly and cause unauthorized moderation or content loss.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation explicitly states the message APIs are unauthenticated and includes create, reply, and delete operations. That means any caller can impersonate arbitrary users via the supplied uid field and modify or remove public content, enabling spam, defacement, and data-integrity abuse; in a blog-management skill with CLI exposure, this is more dangerous because it operationalizes direct misuse of the public endpoints.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation exposes a hard-delete operation for moods and explicitly states it is irreversible, but provides no confirmation, safety guidance, or guardrails for invocation. In an agent skill context, this increases the chance of accidental destructive actions, especially because the broader skill metadata indicates unauthenticated public APIs and CLI-style subcommand use.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation exposes a GET endpoint that performs a state-changing action by incrementing article popularity, but the side effect is only briefly noted and not clearly warned as a behavioral/security concern. Using GET for mutation is unsafe because crawlers, link previewers, prefetchers, caches, or third-party embeds can trigger requests unintentionally, allowing artificial inflation of metrics and violating expected HTTP semantics.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly states the upload area is unauthenticated and that uploaded files are directly accessible under /uploads/, but it does not warn users about the privacy, abuse, and hosting risks of publicly storing arbitrary files. In a skill that manages a blog system with no authentication, this omission can lead operators to expose public file hosting functionality without understanding the security consequences.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The delete endpoint is destructive and, per the file header, unauthenticated, yet the documentation presents it as a normal operation without prominently warning that anyone who can reach the API may delete uploaded content. In context, this increases the risk of accidental or unauthorized data loss and service disruption.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The document explicitly states the user API is unauthenticated and shows a POST /api/users example that includes a plaintext password field. In the context of a public blog-management skill, this normalizes credential creation over an unauthenticated endpoint, enabling arbitrary account creation and exposing credentials to interception if transport security or deployment hygiene is weak.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The admin-delete-articles capability performs destructive bulk deletion with no confirmation, dry-run, or warning. In an agent setting, that increases the chance of accidental or socially engineered destructive actions against a live blog backend.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The upload commands read local files and transmit their contents to a remote server without any built-in disclosure, preview, or confirmation. In an agent workflow, this can lead to unintended exfiltration of local sensitive files if a user or higher-level instruction supplies a dangerous path.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

"""
    creds = {}
    creds.update(_load_from_project_knowledge())
    for k, v in os.environ.items():
        u = k.upper()
        if u.startswith(_CRED_PREFIX):
            if 'USERNAME' in u or u.endswith('_USER'):

• Confidence: 97% confidence
• Finding: The skill iterates over environment variables to collect credentials and configuration, which is secret-harvesting behavior. In this context it is more concerning because the tool is presented as a public no-auth blog client, yet it still inspects local secret sources and can later transmit discovered values to remote endpoints.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.20.0

• Confidence: 98% confidence
• Finding: The dependency is specified as `requests>=2.20.0`, which is unpinned and permits installation of a broad range of versions depending on resolver behavior and environment state. This undermines reproducibility and can allow vulnerable or untested versions to be installed, especially since the lower bound includes historically vulnerable releases.

Known Vulnerable Dependency: requests==2.20.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: The version specifier allows `requests==2.20.0`, a version with multiple known advisories, so environments may resolve to or retain a vulnerable release. In a skill that manages a public blog system and likely performs HTTP interactions, known Requests flaws can expose credentials, weaken TLS/request validation, or introduce other network security risks depending on usage.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

响应：`{"code":200,"message":"文章更新成功"}` · 404 文章不存在 · 400 无更新字段

## 5. DELETE /api/articles/{article_id} — 删除文章

**子命令**：`delete-article`

• Confidence: 94% confidence
• Finding: The skill exposes a deletion subcommand for articles, including hard delete via the soft=false parameter, in a system explicitly described as having no authentication. In an agent context, this is dangerous because a natural-language request or prompt injection could induce destructive actions against live content without any authorization, confirmation, or scope restriction.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

响应：`{"code":200,"data":{"id":1}}`

## 4. DELETE /api/messages/{message_id} — 删除留言

**子命令**：`delete-message`

• Confidence: 94% confidence
• Finding: The documented delete operation exposes a destructive action against a path parameter with no authentication noted, making it easy for an agent or user to delete arbitrary messages by ID. In this skill context, which advertises blog management and CLI subcommands over unauthenticated public APIs, the endpoint materially increases the risk of unauthorized content removal and moderation abuse.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

响应：`{"code":200,"data":{"id":2}}`

## 3. DELETE /api/moods/{mood_id} — 删除说说

**子命令**：`delete-mood`

• Confidence: 97% confidence
• Finding: The documented DELETE /api/moods/{mood_id} endpoint is a destructive action parameterized solely by a user-controlled ID, with no mention of authentication, authorization, ownership checks, or confirmation controls. Given the skill metadata explicitly says the APIs are unauthenticated public endpoints, an agent or attacker could delete arbitrary mood records by supplying IDs, making this a real tool-parameter abuse risk.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: SKILL.md:206