blog-mini-ljt

• Outcome: Review
• Latest audit: Aug 24, 2026 · 5:08 PM UTC
• Version: 1.0.0

Overview

This skill is a real blog-management wrapper, but it can modify or delete live remote blog data and upload local files with weak scoping and no clear confirmation safeguards.

Review this skill before installing. Only use it against a blog instance you own or are authorized to manage, set an explicit trusted HTTPS base URL, avoid the built-in default remote host for testing, and require manual confirmation before uploads, user creation, admin login, or any delete operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and instructs use of network access, environment-variable reads, and local file reads without declaring any explicit permissions boundary. That mismatch is dangerous because an agent may access local configuration (.project-info), environment values, and upload local files to a remote API with no clear consent or sandbox expectations, expanding the effective attack surface beyond what a user may realize.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill description repeatedly frames the API as 'unauthenticated/public', but the documented admin module introduces privileged authenticated operations, including login and hard-delete actions. This mismatch can mislead an agent or operator about trust boundaries and cause unsafe invocation of sensitive functions under the assumption that all endpoints are low-risk content-management actions.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest-level description omits powerful capabilities such as user creation and authenticated backend administration, making the skill appear narrower and safer than it is. Capability under-disclosure is dangerous because agents may select or invoke the skill without understanding that it can alter identities and perform privileged backend actions.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest normalizes administrative authentication as a routine 'readonly' test and explicitly documents a default admin/admin login, which materially expands the skill beyond a simple unauthenticated public blog API. Even if the login action itself is not state-changing, it facilitates privileged access and may encourage automated use of default credentials against live instances, leading to unauthorized administration if defaults remain enabled.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill includes multiple destructive operations such as delete-article, delete-comment, delete-message, delete-mood, delete-upload, and admin bulk deletion, but does not require confirmation or prominently warn before irreversible actions. In an agent setting, this can lead to accidental or prompt-induced mass deletion of blog content or files, especially because some deletes are hard deletes and the API is described as publicly accessible.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The documented upload commands encourage sending arbitrary local files to a remote service but provide no privacy, sensitivity, or destination warning. This is risky because an agent could upload secrets, internal documents, or personal data from local paths, and the skill's own configuration model includes reading local/project configuration that could make such exfiltration easier.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The article deletion endpoint supports both soft delete and hard delete via a query flag, but the documentation does not instruct the agent to seek confirmation or warn users before destructive use. In an agent context, ambiguous delete semantics can easily lead to unintended content removal, especially if `soft=false` is passed or defaults are misunderstood.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The mood deletion endpoint is explicitly hard-delete and irreversible, yet the warning is only a brief note rather than a strong operational safeguard. An agent using this skill could permanently remove user content without verifying intent, creating avoidable data-loss risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The uploaded-file deletion endpoint removes stored content but lacks guidance about downstream impact, such as broken links, lost media, or irreversible removal. In a content-management skill, file deletion can silently damage published articles and pages if invoked without dependency checks or confirmation.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The admin bulk article deletion endpoint performs authenticated hard deletion of multiple articles and is only lightly described, despite being one of the highest-risk actions in the skill. Because the skill targets AI agents for full blog management, insufficient warning around bulk irreversible deletion materially increases the chance of catastrophic data loss from misuse, prompt injection, or operator error.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill exposes commands that read arbitrary local file paths and transmit the file contents to a remote server, but it provides no user-facing warning, allowlist, or confirmation step before exfiltrating local data. In this skill’s context, that risk is elevated because the API is explicitly unauthenticated and has a built-in default remote host, so an agent could upload sensitive workspace files to an external service with minimal friction.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The admin login command sends administrator credentials to a remote server without any explicit warning or trust validation, and the default base URL uses plain HTTP rather than HTTPS. This creates a direct risk of credential disclosure via interception or by sending secrets to an untrusted endpoint, especially because the skill is designed for autonomous agent use and can operate against a built-in external host.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The notes state that the script has a built-in default base URL and can run without configuration, which creates a risk that tests or agent actions will be directed at an unintended remote blog instance. In combination with mutable operations and admin login guidance, these broad defaults increase the chance of accidental interaction with production or third-party systems.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The manifest includes mutable test cases that create persistent data, and explicitly notes that some created objects cannot be deleted through the API, yet it does not present a prominent upfront warning before these tests are used. This can cause silent pollution of live datasets and leaves operators unaware that normal validation will have lasting side effects.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The manifest defines multiple live remote mutable actions and an admin login flow but does not clearly warn that these operations affect real system data and may require authorization. In an agent context, this omission is dangerous because automated execution may proceed under the assumption that these are harmless validation steps, resulting in unauthorized writes or administrative access attempts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.20.0

• Confidence: 96% confidence
• Finding: The dependency is specified with a lower bound only (`requests>=2.20.0`), which allows installation of unpredictable versions and can permit vulnerable releases such as 2.20.0. In an agent skill that manages blog content and may make outbound HTTP requests to a built-in public API, this weak pinning increases supply-chain risk and makes secure, reproducible deployments harder.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Body 字段**：`title`(str,可选), `content`(str,可选), `lid`(int,可选), `img`(str,可选), `heat`(int,可选)。至少传一个字段。
**响应**：`{"code":200,"message":"文章更新成功"}`

### 1.6 DELETE /api/articles/{id} — 删除文章

| 项 | 值 |
|---|---|

• Confidence: 85% confidence
• Finding: This skill exposes a deletion primitive that can remove articles by ID, including hard deletion via `soft=false`, with no indication of authorization, confirmation, scoping, or anti-abuse controls on the public API. In an agent setting, an attacker who can influence prompts or parameters could steer the tool toward deleting arbitrary content, making the endpoint highly susceptible to parameter abuse.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**响应**：`{"code":200,"data":[{"id":1,"uid":1,"aid":3,"content":"...","deleted":0,"createtime":"...","uname":"admin","img":"img/moren.jpg"}]}`

### 2.3 DELETE /api/comments/{id} — 删除评论（软删除）

| 项 | 值 |
|---|---|

• Confidence: 84% confidence
• Finding: The comment deletion endpoint allows arbitrary deletion by comment ID and appears to be part of the unauthenticated public API. Without ownership checks, role checks, or confirmation requirements, an agent can be manipulated into deleting comments outside user intent, enabling censorship or content tampering.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Body 字段**：`uid`(int,必填), `mid`(int,必填,被回复的留言 ID), `content`(str,必填)
**响应**：`{"code":200,"data":{"id":1}}`

### 4.4 DELETE /api/messages/{id} — 删除留言（软删除）

| 项 | 值 |
|---|---|

• Confidence: 84% confidence
• Finding: The message deletion endpoint provides a direct destructive action by ID on a public-facing content object. Because the skill is designed for broad blog-management automation, prompt- or parameter-manipulation could cause unauthorized removal of visitor messages at scale if no server-side controls exist.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Body 字段**：`content`(str,必填), `title`(str,默认""), `src`(str,默认"")
**响应**：`{"code":200,"data":{"id":1}}`

### 5.3 DELETE /api/moods/{id} — 删除说说

| 项 | 值 |
|---|---|

• Confidence: 88% confidence
• Finding: This endpoint performs irreversible deletion of moods by ID, combining strong destructive power with minimal safety context. In an AI-agent workflow, any loosely specified or attacker-influenced ID can lead to permanent loss of posts without recovery, which makes parameter abuse particularly dangerous.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**响应**：`{"code":200,"data":[{"filename":"xxx.png","url":"/uploads/xxx.png","type":"image","size":12345}]}`

### 6.4 DELETE /api/uploads/{filename} — 删除已上传文件

| 项 | 值 |
|---|---|

• Confidence: 87% confidence
• Finding: Deleting uploaded files by filename is especially abuse-prone because filenames can be attacker-controlled, guessed, or selected from a broad shared namespace. An agent induced to call this endpoint could remove assets backing multiple pages or posts, causing immediate service/content damage.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: SKILL.md:269