claude-blog-brain
Warn
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the subprocess module to execute local Python scripts and system commands, specifically within claude_blog_brain/cli.py, quality_gate.py, and sync_flow.py. Additionally, the top-level plugin manifest in plugin.json explicitly grants Bash tool access, which allows the agent to execute shell commands within the host environment.
- [REMOTE_CODE_EXECUTION]: Installation instructions in README.md and docs/INSTALLATION.md promote high-risk patterns involving piping remote shell scripts from GitHub directly to bash or pwsh. Furthermore, the scripts/sync_flow.py utility dynamically downloads and stores markdown-based instruction files (prompts) from a remote GitHub repository at runtime, which are then utilized by the agent's logic.
- [PROMPT_INJECTION]: The skill's core functionality involves processing large amounts of untrusted content from the public web via WebSearch and WebFetch, creating a significant surface for indirect prompt injection. While the author has implemented sophisticated countermeasures, including a nonce-bound fencing contract and sanitization helpers in scripts/load_untrusted_root.py, the inherent risk of an AI agent acting on instructions embedded in external content persists.
- [DATA_EXFILTRATION]: The skill interacts with numerous external services (Google AI, Search Console, PageSpeed, YouTube, and various CMS platforms) and manages sensitive API credentials. The combination of broad network permissions and the processing of untrusted external data represent potential risk paths for the unauthorized extraction of credentials or site metadata.
Audit Metadata