360 Secure SkillHub
360 安全技能中心

Halo Blog Manager

通过 Halo CMS 官方 API 管理博客：登录后创建、编辑、删除文章，管理分类、标签、评论，上传媒体附件；凭据存于本地配置文件，会话过期后可重新登录。包含删除类高风险操作。

siyrs
siyrs
热度 36.77
最近更新 2026-05-11 17:37:19
分类：营销依赖：代码执行 / 读写文件 / 第三方 API应用场景：博客写作 / 社交媒体 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add halo-blog-manager
Metadata
name
halo-manager
description
Manage Halo blogs via API - create/edit/delete posts, manage categories/tags, handle comments, upload media. Use when user asks to manage their Halo blog, post articles, check blog stats, or perform any Halo CMS operations. Triggers on 'halo blog', 'halo cms', 'manage blog', 'post to halo', 'halo api'.

Halo Manager

Manage Halo blogs through the official API.

First-Time Setup

When this skill is first used, ask the user for:

  1. Blog URL (e.g., https://blog.example.com)
  2. Username
  3. Password

Then save credentials to ~/halo-manager/config.json:

{
  "blog_url": "https://blog.example.com",
  "username": "your-username",
  "password": "your-password"
}

Security Note: Never expose credentials in logs, responses, or shared channels.

Authentication

Halo uses RSA-encrypted password + CSRF token + Session cookie.

Login Flow

  1. GET /login - Extract CSRF token and RSA public key
  2. Encrypt password with RSA public key (JSEncrypt)
  3. POST /login with form data (username, encrypted password, CSRF token)
  4. Receive SESSION cookie for subsequent requests

Session Management

  • Use SESSION cookie for all authenticated requests
  • If session expires, re-login automatically
  • Store session state in ~/halo-manager/session.json

API Endpoints

Console API Base

{blog_url}/apis/api.console.halo.run/v1alpha1/

Posts

Operation Method Endpoint
List posts GET /posts
Get post GET /posts/{name}
Create post POST /posts
Update post PUT /posts/{name}
Delete post DELETE /posts/{name}

Categories

Operation Method Endpoint
List categories GET /categories
Create category POST /categories
Update category PUT /categories/{name}
Delete category DELETE /categories/{name}

Tags

Operation Method Endpoint
List tags GET /tags
Create tag POST /tags
Update tag PUT /tags/{name}
Delete tag DELETE /tags/{name}

Users

Operation Method Endpoint
List users GET /users
Get current user GET /users/-

Comments

Operation Method Endpoint
List comments GET /comments
Approve comment PUT /comments/{name}/approval
Delete comment DELETE /comments/{name}

Media

Operation Method Endpoint
List attachments GET /attachments
Upload attachment POST /attachments
Delete attachment DELETE /attachments/{name}

Common Workflows

Create a Post

  1. Login to get session
  2. Prepare post data:
{
  "post": {
    "spec": {
      "title": "Post Title",
      "slug": "post-slug",
      "content": "Post content in Markdown",
      "rawType": "markdown",
      "categories": ["category-name"],
      "tags": ["tag1", "tag2"],
      "publish": true
    }
  }
}
  1. POST to /posts
  2. Verify creation

Upload Media

  1. Login to get session
  2. Prepare multipart form data
  3. POST to /attachments
  4. Get attachment URL from response

Error Handling

Status Meaning Action
401 Unauthorized Re-login
403 Forbidden Check permissions
404 Not found Verify resource exists
500 Server error Retry or report

Output Format

【操作名称】

请求：{method} {endpoint}
状态：{status_code}
结果：成功/失败

详情：...

Security Best Practices

  1. Never log credentials - Mask passwords in all outputs
  2. Use HTTPS - Always prefer secure connections
  3. Session timeout - Re-authenticate when session expires
  4. Local storage only - Credentials stay on user's machine

References