blog-toolkit

• Outcome: Review
• Latest audit: Aug 21, 2026 · 1:44 PM UTC
• Version: 1.0.0

Overview

This blog-management skill is mostly disclosed and purpose-aligned, but it can upload, create, update, and delete public blog content on a dynamically chosen unauthenticated API without confirmation guardrails.

Install only if you intend to give the agent blog-admin authority over the configured API. Verify the resolved BLOG_TOOLKIT_BASE_URL before uploads or deletes, avoid using production targets without backups, and prefer updating the skill to require confirmations and a safer requests version range.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises environment-variable access, project file reads, and arbitrary network access to a runtime-supplied base URL, but it does not declare permissions or trust boundaries. This creates a real security gap because operators and higher-level tooling cannot accurately assess that the skill can read local configuration and send data to external endpoints, increasing the risk of unintended SSRF-like access to internal services or leakage of locally sourced data.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill recursively scans local .project-info/member files to discover a base URL, which exceeds the expected behavior of a 'pure CLI' API wrapper and creates an unnecessary local data access surface. Even though it aims to extract only non-sensitive host information, it reads arbitrary project files and parses their contents, which can unexpectedly ingest workspace data and connect to attacker-controlled endpoints if poisoned project metadata is present.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The docstring states that only non-sensitive base_url/api_url/host values are read, but the implementation calls a helper that enumerates all BLOG_TOOLKIT-prefixed environment variables, including usernames, passwords, tokens, and API keys. This mismatch increases the risk of over-collection of secrets and undermines user expectations about what the tool inspects.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill exposes multiple destructive delete operations, including hard delete behavior for articles, but provides no explicit warning, dry-run mode, or confirmation guidance before irreversible actions. In a CLI admin context, this increases the chance of accidental or socially induced destructive actions against production content.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill documents file upload and deletion features without warning that local files will be transmitted to a remote server or that remote stored files may be permanently removed. Because the base URL is dynamically sourced from environment, project files, or interactive input, this is more dangerous than a fixed trusted endpoint: users may unknowingly exfiltrate local files to an untrusted host or delete remote assets unintentionally.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The upload commands send local file contents to a remote server immediately once invoked, with no execution-time warning, destination preview, or confirmation. In a skill that can auto-discover its target base URL, this raises the chance of accidental exfiltration of sensitive local files to an unintended or attacker-influenced endpoint.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: Delete operations trigger destructive remote actions without any confirmation, dry-run support, or guardrails. Given this skill targets an unauthenticated public API and includes hard-delete capability, operator mistakes or misuse can lead to irreversible content loss.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _load_credentials():
    """动态扫描环境变量获取认证凭据（前缀由 skill name 推导）。"""
    creds = {}
    for k, v in os.environ.items():
        u = k.upper()
        if u.startswith(_CRED_PREFIX):
            if 'USERNAME' in u or u.endswith('_USER'):

• Confidence: 93% confidence
• Finding: The helper enumerates all environment variables and collects any BLOG_TOOLKIT-prefixed values, including potential secrets such as passwords, tokens, and API keys, even when authentication is disabled. Broad environment harvesting is dangerous because it increases secret exposure within the process and can combine with errors, logging, future code changes, or dependency compromise to leak credentials that were not needed for the current operation.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.20.0

• Confidence: 97% confidence
• Finding: The dependency is specified as `requests>=2.20.0`, which is unpinned and permits installation of a very old vulnerable version as well as future breaking or insecure releases. In a security-sensitive CLI that manages a public unauthenticated blog API, network-facing HTTP behavior is central, so uncontrolled dependency resolution increases supply-chain and runtime risk.

Known Vulnerable Dependency: requests==2.20.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: Because `requests>=2.20.0` allows `requests==2.20.0`, the requirement admits a version with multiple known vulnerabilities, including credential leakage and request verification issues. This is especially dangerous for a CLI that interacts with remote APIs, because malformed or attacker-controlled URLs, redirects, or network interactions could trigger vulnerable library behavior.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- 响应：`{"code":200,"data":{...}}`
- 子命令：`update-article`

### 5. DELETE /api/articles/{article_id} — 删除文章
- 参数（path）：`article_id*(int)`；（query）：`soft(bool,默认true)`，soft=false 硬删除
- 响应：`{"code":200,"data":{...}}`
- 子命令：`delete-article`

• Confidence: 96% confidence
• Finding: The skill documents an unauthenticated delete endpoint for articles, including a `soft=false` option for permanent deletion. In the context of a CLI management skill, this materially enables destructive parameter abuse: a user or downstream agent can remove content without authentication, and the hard-delete switch increases blast radius by bypassing reversibility.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- 响应：`{"code":200,"data":{id,...}}`
- 子命令：`create-comment`

### 14. DELETE /api/comments/{comment_id} — 删除评论（软删除）
- 参数（path）：`comment_id*(int)`
- 响应：`{"code":200,"data":{...}}`
- 子命令：`delete-comment`

• Confidence: 94% confidence
• Finding: The documented comment deletion endpoint is a real dangerous capability because the API is explicitly unauthenticated and supports content removal by identifier alone. Even if only soft delete is supported, an attacker or misdirected agent can suppress discussion content and moderate the site without authorization.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- 响应：`{"code":200,"data":{id,...}}`
- 子命令：`reply-message`

### 18. DELETE /api/messages/{message_id} — 删除留言（软删除）
- 参数（path）：`message_id*(int)`
- 响应：`{"code":200,"data":{...}}`
- 子命令：`delete-message`

• Confidence: 94% confidence
• Finding: The message deletion endpoint exposes destructive state-changing behavior without any authentication barrier in the documented API. This is especially risky for an agent-facing CLI because arbitrary message IDs can be targeted, enabling unauthorized censorship or disruption of user communications.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- 响应：`{"code":200,"data":{id,...}}`
- 子命令：`create-mood`

### 21. DELETE /api/moods/{mood_id} — 删除说说
- 参数（path）：`mood_id*(int)`
- 响应：`{"code":200,"data":{...}}`
- 子命令：`delete-mood`

• Confidence: 93% confidence
• Finding: Deleting moods/posts through an unauthenticated endpoint is a true vulnerability because it permits unauthorized content tampering and loss. The skill context increases danger because it packages the operation as an easy administrative command, lowering friction for accidental or abusive use.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- 子命令：`list-uploads`
- 注意：列表项的 `filename` 即存储文件名（hash），可直接用于 delete-upload

### 25. DELETE /api/uploads/{filename} — 删除已上传文件
- 参数（path）：`filename*(str)` — 存储文件名（hash，即 upload 返回 `data.url` 路径末段，或 list-uploads 返回的 `filename`）
- 响应：`{"code":200,"message":"文件已删除"}`
- 子命令：`delete-upload`

• Confidence: 97% confidence
• Finding: An unauthenticated file deletion endpoint is a high-risk destructive capability, especially because the skill also exposes upload listing, making filenames discoverable and deletions straightforward. This can be abused to remove site assets or user-uploaded content, causing data loss and service disruption.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def cmd_delete_upload(args):
    """能力 Y：删除已上传文件。"""
    # DELETE /api/uploads/{filename}
    return _api_request('DELETE', '/api/uploads/%s' % args.filename)

• Confidence: 66% confidence
• Finding: Unlike numeric delete IDs, delete-upload interpolates an arbitrary filename directly into the URL path without URL encoding or validation. This can produce unintended request paths if the filename contains slashes, traversal-like segments, or reserved characters, potentially targeting the wrong server resource depending on backend routing behavior.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: test-vars.json:5