ClawHub
Back to skill

Security audit

blog-publish

Security checks for vulnerabilities and agentic risk

Overview

This blog-publishing skill mostly matches its purpose, but it includes extra repository/agent workflow instructions and unnecessary credential scanning that warrant review before installation.

Review this skill before installing. Use it only with a trusted blog API base URL, avoid setting BLOG_PUBLISH token/password/API-key variables unless the credential loader is removed or tightened, and do not use --hard unless permanent deletion is intended. The repository/Issue/PR/A2A instructions should be removed or split into a separate clearly scoped collaboration skill.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill uses environment-variable access, project file reads, and outbound network calls but does not declare corresponding permissions. This creates a capability transparency problem: operators may approve or invoke the skill without realizing it can read local configuration and contact arbitrary blog API endpoints, which can expose internal URLs or sensitive deployment metadata.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill claims to only handle blog API functions, yet it also instructs the agent to create PR comments and participate in Issue/PR workflows. This hidden expansion into repository collaboration can cause the agent to act in another system boundary, potentially posting unreviewed content or making workflow changes not expected by the user or platform owner.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The documented scope says the skill is limited to article/tag/file-upload actions, but later sections require PR creation and A2A workflow actions. That mismatch undermines least surprise and can lead to unauthorized cross-tool actions in source-control or agent-orchestration contexts.

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
Instructions to create PRs and perform Issue/agent workflow operations are outside the stated blog-publishing function and represent scope drift into repository and orchestration control. Such drift is dangerous because users may authorize a content-publishing skill without expecting it to modify collaboration state or trigger downstream agents.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill claims to use a public unauthenticated API, yet it scans .project-info and environment variables for usernames, passwords, tokens, and API keys. This unnecessarily broad secret access expands the skill’s privilege surface and can expose sensitive material to code paths that do not need it, especially if the target base URL is user-supplied.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The documentation states that no authentication is required, but the implementation still includes logic to collect secret material such as passwords, tokens, and API keys. This mismatch is dangerous because operators may trust the description and run the skill in sensitive environments without realizing it harvests available secrets.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
"""
    creds = {}
    creds.update(_load_from_project_knowledge())
    for k, v in os.environ.items():
        u = k.upper()
        if u.startswith(_CRED_PREFIX):
            if 'BASE_URL' in u:
Confidence
95% confidence
Finding
The code iterates across environment variables and extracts any values matching the BLOG_PUBLISH prefix, including usernames, passwords, tokens, and API keys. Environment harvesting is especially risky in agent contexts because environments often contain unrelated secrets, and the skill also accepts an interactive base URL that could direct subsequent requests to attacker-controlled infrastructure.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.20.0
Confidence
93% confidence
Finding
The dependency is specified as `requests>=2.20.0`, which is unpinned and allows installation of any future version that satisfies the lower bound. This undermines reproducibility and can unintentionally introduce vulnerable or breaking versions into the skill's environment, which is especially relevant for a publishing skill that likely performs outbound HTTP requests and may process URLs, authentication, and uploads.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
def cmd_delete_article(args):
    """能力 F：删除文章（默认软删除，--hard 硬删除不可恢复）"""
    # DELETE /api/articles/{id}?soft=true|false
    soft = 'false' if args.hard else 'true'
    return _api_request('DELETE', f'/api/articles/{args.id}', params={'soft': soft})
Confidence
87% confidence
Finding
The skill exposes a destructive delete operation with a --hard option that performs irreversible deletion based solely on a caller-supplied article ID. In an agent setting, this increases the chance of accidental or induced destructive actions, and there are no built-in safeguards such as confirmation prompts, dry-run support, or authorization checks in the client.

Static analysis

No suspicious patterns detected.