Is Claude Blog safe?
- Python shell/command execution
- MCP server launches a host command
- Python filesystem write/delete
claude-blog is an AI python_package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 8 risky constructs are reported for review. It can: delegated authentication, filesystem read, filesystem write, mcp tools detected, network egress and shell execution — capabilities are what the code can do, not a verdict on intent. Risk score 10/100 (low).
claude-blog 2.1.1
Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of Claude Blog's authors. Report a false positive.
Behavioral traits
How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.
Findings (8)
An MCP server entry launches a command on your host.
"command": "npx",
Why it matters: Trusting the manifest means running that binary — verify what it is and where it comes from.
Fix: Verify the launched command and its source before trusting this MCP server configuration.
The component can run operating-system commands or spawn processes.
result = subprocess.run(
["git", "diff", "--cached", "--name-only"],
check=False,
capture_output=True,
text=True,
)result = subprocess.run(
["gh", "auth", "token"], capture_output=True, text=True
)return subprocess.call([PY, str(REPO / "scripts" / script), *args], cwd=REPO)
return subprocess.run([PY, str(REPO / "scripts" / script), *args], cwd=REPO, text=True, capture_output=True, check=False)
return subprocess.run(
command,
cwd=REPO,
text=True,
capture_output=True,
timeout=EXEC_TIMEOUT_SECONDS,
check=False,
)subprocess.run([PY, *args], cwd=REPO, check=True)
proc = subprocess.run(["git", "diff", "--quiet", "--", rel], cwd=REPO, check=False)
proc = subprocess.run(
[sys.executable, str(audit), "--require", "market-ready", "--json"],
cwd=REPO,
text=True,
capture_output=True,
check=False,
)proc = subprocess.run(["git", "ls-files", "-z", "--cached"], cwd=REPO, capture_output=True, check=False)
proc = subprocess.run(args, cwd=REPO, capture_output=True, check=False)
proc = subprocess.run(["git", "ls-files", "-z", "--others", "--exclude-standard"], cwd=REPO, capture_output=True, check=False)
proc = subprocess.run(["git", "rev-parse", "HEAD"], cwd=REPO, capture_output=True, text=True, check=False)
result = subprocess.run(
["git", "diff", "--cached", "--name-only"],
check=False,
capture_output=True,
text=True,
)result = subprocess.run(
["gh", "auth", "token"], capture_output=True, text=True
)subprocess.run(
["ffmpeg", "-y", "-i", wav_path, "-codec:a", "libmp3lame",
"-b:a", "192k", "-ar", "24000", "-ac", "1", str(tmp_path)],
check=True, capture_output=True,
)result = subprocess.run([sys.executable, str(setup_script)])
result = subprocess.run(cmd)
subprocess.run(
[str(self.venv_pip)] + install_args,
check=True, capture_output=True, text=True,
)result = subprocess.run(["gh", "auth", "token"], capture_output=True, text=True, timeout=5)
result = subprocess.run([sys.executable, str(setup_script)])
Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.
Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; avoid shell=True.
A server is bound to all network interfaces (0.0.0.0), not just your own machine.
"0.0.0.0",
Why it matters: Without authentication, other hosts on the network can reach it.
Fix: Bind to 127.0.0.1 for local-only use, or require authentication and restrict access if remote exposure is intended.
The component reads files from disk.
raw = path.read_text(encoding="utf-8")
raw = counter_path.read_text(encoding="utf-8").strip()
data = json.loads(cfg_path.read_text(encoding="utf-8"))
raw = html_path.read_text(encoding="utf-8")
text = review.read_text(encoding="utf-8")
text = path.read_text(encoding="utf-8")
content = path.read_text(encoding="utf-8")
current = path.read_text(encoding="utf-8")
old_lock = lock_path.read_text(encoding="utf-8")
text = path.read_text(encoding="utf-8", errors="replace")
text = path.read_text(encoding="utf-8", errors="replace")
text = path.read_text(encoding="utf-8", errors="replace")
text = path.read_text(encoding="utf-8", errors="replace")
data = json.loads(path.read_text(encoding="utf-8"))
return path.read_text(encoding="utf-8", errors="replace")
data = json.loads(marker.read_text(encoding="utf-8"))
links += len(re.findall(r"!?\[\[([^\]]+)\]\]", path.read_text(encoding="utf-8", errors="replace")))
data = json.loads(manifest_path.read_text(encoding="utf-8"))
text = hot.read_text(encoding="utf-8") if hot.exists() else ""
data = json.loads(Path(path).read_text(encoding="utf-8"))
schema = json.loads(SCHEMA_PATH.read_text(encoding="utf-8"))
raw_bytes = source.read_bytes()
data = json.loads(Path(path).read_text(encoding="utf-8"))
schema = json.loads(SCHEMA_PATH.read_text(encoding="utf-8"))
raw = source.read_bytes()
Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.
Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.
The component writes or deletes files on disk.
analyze_blog._safe_write_text(output_path, output)
_safe_write_text(args.output, output)
_safe_write_text(args.output, output)
_safe_write_text(args.output, output)
path.write_text(data, encoding="utf-8")
(draft_dir / "capabilities.json").write_text(json.dumps(capabilities, indent=2), encoding="utf-8")
(draft / "preflight-report.json").write_text(json.dumps(report, indent=2), encoding="utf-8")
out_html.write_text(rendered, encoding="utf-8")
os.unlink(tmp_path)
_atomic_write_bytes(hero_path, img_bytes)
(out_dir / "hero-credit.txt").write_text(
f"AI-generated via {used_model}. No attribution required.\nPrompt: {prompt}\n",
encoding="utf-8",
)_atomic_write_bytes(hero_path, img_bytes)
(out_dir / "hero-credit.txt").write_text(credit, encoding="utf-8")
_atomic_write_bytes(hero_path, img_bytes)
(out_dir / "hero-credit.txt").write_text(credit, encoding="utf-8")
_atomic_write_bytes(hero_path, img_bytes)
(out_dir / "hero-credit.txt").write_text(credit, encoding="utf-8")
_atomic_write_bytes(hero_path, img_bytes)
(out_dir / "hero-credit.txt").write_text(
f'"{title}" by {creator}\nLicense: {license_name}\nSource: {source}\nURL: {src_url}\n',
encoding="utf-8",
)analyze_blog._safe_write_text(args.output, rendered)
Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.
Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.
The component makes outbound network requests.
import urllib.parse
parsed = urllib.parse.urlparse(url)
import urllib.parse
import urllib.request
parsed = urllib.parse.urlparse(ref)
raw_path = urllib.parse.unquote(parsed.path)
parsed = urllib.parse.urlparse(str(host))
parsed = urllib.parse.urlparse(url)
parsed = urllib.parse.urlparse(url)
parsed = urllib.parse.urlparse(url)
parsed = urllib.parse.urlparse(req_url)
req_path = Path(urllib.request.url2pathname(parsed.path)).resolve()
parsed = urllib.parse.urlparse(req_url)
req_path = Path(urllib.request.url2pathname(parsed.path)).resolve()
_PREFLIGHT_NO_REDIRECT_OPENER = urllib.request.build_opener(_PreflightNoRedirectHandler())
req = urllib.request.Request(url, method="HEAD", headers={"User-Agent": USER_AGENT})target = urllib.parse.unquote(href[1:])
import urllib.parse
import urllib.request
parsed = urllib.parse.urlparse(value)
parsed = urllib.parse.urlparse(url)
path = Path(urllib.request.url2pathname(parsed.path)).resolve()
import urllib.parse
import urllib.request
parsed = urllib.parse.urlparse(url)
Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.
Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.
An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential. (2 occurrence(s) shown as evidence).
"grant_type": "refresh_token",
"grant_type": "authorization_code",
Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.
An MCP tool surface (manifest or tool definitions) was found.
"mcpServers": {Why it matters: Just context — review which tools it offers and their permissions.
Fix: Review the declared MCP tools and their permissions.
Check your own component
Run the same evidence-backed scan on any MCP server, agent skill, or package.
Scan your own componentHow we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →