wordpress-mcp

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:31 AM UTC
• Version: 1.0.6

Overview

The skill has a coherent WordPress MCP setup purpose, but its scripts and references handle credentials, agent configuration, and remote plugin installs in ways that require careful review before use.

Install only if you are comfortable reviewing and manually controlling the high-trust steps. Use dry-run first, pin exact plugin and npm versions, require checksums, use HTTPS only, avoid passing secrets on command lines, prefer least-privileged WordPress service accounts, and review any changes to local MCP client configuration before restarting agents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T08 · Insecure Dependencies

Error

• Location: references/mcp-adapter-guide.md:27
• Finding: Mutable GitHub releases and development branches are installed as executable WordPress plugins<![CDATA[ ## Vulnerability Details **File Location**: `references/mcp-adapter-guide.md:27-56` **Vulnerability Type**: Unpinned executable dependency installation **Risk Level**: High ### Vulnerable Code ```bash ### Option 1: WP-CLI with release ZIP (recommended — no composer) wp plugin install https://github.com/WordPress/mcp-adapter/releases/latest/download/mcp-adapter.zip --activate --path=$WP_PATH wp rewrite flush --path=$WP_PATH ### Option 2: Manual download + copy (when wp plugin install fails) cd /tmp curl -L -o mcp-adapter.zip "https://github.com/WordPress/mcp-adapter/releases/latest/download/mcp-adapter.zip" unzip -q mcp-adapter.zip -d /tmp/mcp-adapter-extract sudo cp -r /tmp/mcp-adapter-extract/mcp-adapter $WP_PATH/wp-content/plugins/mcp-adapter sudo chown -R www:www $WP_PATH/wp-content/plugins/mcp-adapter wp plugin activate mcp-adapter --path=$WP_PATH wp rewrite flush --path=$WP_PATH ### Option 3: From source (developers — requires composer) cd /tmp curl -L -o mcp-adapter.zip "https://github.com/WordPress/mcp-adapter/archive/refs/heads/trunk.zip" unzip -q mcp-adapter.zip -d /tmp/mcp-adapter-src mv /tmp/mcp-adapter-src/mcp-adapter-trunk $WP_PATH/wp-content/plugins/mcp-adapter cd $WP_PATH/wp-content/plugins/mcp-adapter composer install --no-dev --no-interaction --optimize-autoloader wp plugin activate mcp-adapter --path=$WP_PATH wp rewrite flush --path=$WP_PATH ``` Additional mutable plugin installation examples occur at: - `references/mcp-adapter-guide.md:78` - `references/mcp-adapter-guide.md:262` - `references/mcp-adapter-guide.md:369` ### Technical Analysis The documented commands retrieve PHP code from mutable GitHub targets and immediately install or activate it. The `latest` release URL can resolve to a different artifact after the Skill has been reviewed, while the `trunk` archive follows an actively changing development branch. The source installation path also runs Composer against metadata from the downloaded branch. This expands t ...[truncated 1328 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace every `latest` and `trunk` installation URL with an exact release tag. 2. Publish a trusted SHA-256 allowlist for each supported version. 3. Require checksum verification before extraction, copying, Composer execution, or plugin activation. 4. Reject installation when the expected checksum is missing. 5. Use release artifacts rather than source-branch archives in production. 6. Review Composer lockfiles and disable Composer plugins and scripts unless explicitly required. 7. Keep development-from-source instructions clearly separated from production installation guidance. ]]>

T08 · Insecure Dependencies

Error

• Location: references/mcp-adapter-guide.md:197
• Finding: Unpinned npm proxy is automatically downloaded and executed with WordPress credentials<![CDATA[ ## Vulnerability Details **File Location**: `references/mcp-adapter-guide.md:197-212` **Vulnerability Type**: Unpinned npm package execution with credential access **Risk Level**: High ### Vulnerable Code ```jsonc { "mcpServers": { "wordpress": { "command": "npx", "args": ["-y", "@automattic/mcp-wordpress-remote@latest"], "env": { "WP_API_URL": "https://your-site.com/wp-json/mcp/mcp-adapter-default-server", "WP_API_USERNAME": "your-username", "WP_API_PASSWORD": "your-application-password", "LOG_FILE": "/path/to/logs/mcp-adapter.log" } } } } ``` Equivalent unpinned proxy configurations also occur at: - `references/mcp-config.md:297-310` - `references/mcp-config.md:317-325` ### Technical Analysis The MCP client is configured to invoke `npx -y` with `@latest`. This causes npm code selected at execution time to be downloaded and run without interactive confirmation. The process is deliberately provided with the WordPress endpoint, username, and application password. Although the package name belongs to the expected Automattic namespace, using `@latest` means the effective code can change after review. A compromised npm account, malicious release, or upstream build pipeline could therefore gain direct access to the supplied credentials. ### Attack Path 1. The npm package, maintainer account, or release pipeline is compromised. 2. A malicious version is published as the latest version. 3. The MCP client starts the configured server. 4. `npx -y` automatically downloads and executes the malicious release. 5. The package reads `WP_API_USERNAME` and `WP_API_PASSWORD` from its environment. 6. The credentials are exfiltrated or used to invoke privileged WordPress MCP operations. ### Impact Assessment The package runs with the local privileges of the MCP client and receives WordPress credentials. It could therefore: - Authenticate to the configured WordPress site. - Invoke any abilities ...[truncated 288 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a reviewed exact package version. 2. Prefer a locally installed dependency managed by a lockfile rather than runtime `npx` retrieval. 3. Use `npx --no-install` after installing and verifying the package separately. 4. Verify npm provenance, package signatures, integrity metadata, and maintainership before use. 5. Supply credentials through a restricted secret provider rather than literal MCP configuration values. 6. Use a dedicated, least-privileged WordPress account and a revocable application password. 7. Restrict outbound network access for the proxy process to the approved WordPress hostname. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/install_wp_plugin.sh:127
• Finding: Plugin installer treats a missing checksum as successful verification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install_wp_plugin.sh:127-181` **Vulnerability Type**: Optional integrity validation before activating downloaded PHP **Risk Level**: High ### Vulnerable Code ```bash verify_checksum() { local file="$1" local sha256var="WP_${PLUGIN^^}_SHA256" local expected="${!sha256var:-}" if [ -z "$expected" ]; then return 0 fi echo "→ Verifying SHA-256 checksum..." local actual actual=$(sha256sum "$file" | awk '{print $1}') if [ "$actual" != "$expected" ]; then echo "Error: SHA-256 mismatch for $file (expected $expected, got $actual)" >&2 return 1 fi echo " checksum OK" } if [ "$PLUGIN" = "mcp-adapter" ]; then echo "=== Installing mcp-adapter $VERSION (official WordPress) ===" if [ -d "$PLUGINS_DIR/mcp-adapter" ] && $WP plugin is-active mcp-adapter 2>/dev/null; then echo "mcp-adapter is already installed and active." exit 0 fi RELEASE_TAG="$VERSION" DOWNLOAD_URL="https://github.com/WordPress/mcp-adapter/releases/download/${RELEASE_TAG}/mcp-adapter.zip" echo "→ Downloading mcp-adapter ${RELEASE_TAG}..." if ! curl -fsSL -o "$TMPDIR/mcp-adapter.zip" "$DOWNLOAD_URL"; then echo "Error: failed to download mcp-adapter ${RELEASE_TAG} from ${DOWNLOAD_URL}" >&2 exit 3 fi verify_checksum "$TMPDIR/mcp-adapter.zip" || exit 6 echo "→ Extracting..." unzip -q "$TMPDIR/mcp-adapter.zip" -d "$TMPDIR/extract" SRC=$(find "$TMPDIR/extract" -maxdepth 1 -type d -name 'mcp-adapter*' | head -n 1) if [ -z "$SRC" ]; then echo "Error: extracted folder not found" >&2 exit 3 fi $SUDO rm -rf "$PLUGINS_DIR/mcp-adapter" $SUDO cp -r "$SRC" "$PLUGINS_DIR/mcp-adapter" $SUDO chown -R "${WEB_USER}:${WEB_USER}" "$PLUGINS_DIR/mcp-adapter" echo "→ Activating plugin..." $WP plugin activate mcp-adapter || { echo "Error: activation failed" >&2; exit 4; } ``` The same optional verification routine is used for the AI Engine download at `scripts/install_w ...[truncated 1542 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make an expected SHA-256 value mandatory for every remote archive. 2. Fail closed when the checksum is absent, malformed, or unsupported. 3. Store approved checksums in a version-controlled map keyed by plugin and exact release. 4. Obtain checksums through a channel independent from the downloaded archive. 5. Validate ZIP entries before extraction, including rejection of absolute paths and path traversal entries. 6. Inspect the extracted directory structure and expected plugin metadata before copying. 7. Separate installation from activation and require explicit confirmation after verification. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup_wordpress_mcp.sh:39
• Finding: WordPress credentials are accepted as command-line arguments and may be sent over unencrypted HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup_wordpress_mcp.sh:39-116` **Vulnerability Type**: Credential exposure through process arguments, shell history, and insecure transport **Risk Level**: High ### Vulnerable Code ```bash WP_URL="" WP_USER="" WP_PASS="" AE_TOKEN="" while [ $# -gt 0 ]; do case "$1" in --url) WP_URL="$2"; shift 2 ;; --wp-user) WP_USER="$2"; shift 2 ;; --wp-app-password) WP_PASS="$2"; shift 2 ;; --ai-engine-token) AE_TOKEN="$2"; shift 2 ;; --only) ONLY="$2"; shift 2 ;; --dry-run) DRY_RUN=1; shift ;; --remove) REMOVE=1; shift ;; --platform) TARGET_PLATFORM="$2"; shift 2 ;; -h|--help) sed -n '2,40p' "$0"; exit 0 ;; *) echo "unknown arg: $1" >&2; exit 64 ;; esac done if [ "$REMOVE" -eq 0 ] && [ -z "$WP_URL" ]; then echo "Error: --url is required (e.g. --url https://yourdomain.com)" >&2 exit 1 fi if [ "$REMOVE" -eq 0 ] && [ "$DO_ADAPTER" -eq 1 ]; then if [ -z "$WP_USER" ] || [ -z "$WP_PASS" ]; then printf 'Enter WordPress username: '; read -r WP_USER printf 'Enter Application Password: '; read -r WP_PASS fi fi if [ "$REMOVE" -eq 0 ] && [ "$DO_AI_ENGINE" -eq 1 ] && [ -z "$AE_TOKEN" ]; then printf 'Enter AI Engine Bearer Token: '; read -r AE_TOKEN fi ADAPTER_URL="${WP_URL%/}${MCP_ADAPTER_PATH}" AI_ENGINE_URL="${WP_URL%/}${AI_ENGINE_PATH}" BASIC_AUTH="" if [ "$DO_ADAPTER" -eq 1 ] && [ -n "$WP_USER" ] && [ -n "$WP_PASS" ]; then BASIC_AUTH=$(echo -n "${WP_USER}:${WP_PASS}" | base64) fi ``` The documentation explicitly encourages command-line secret arguments at `SKILL.md:495-502` and `SKILL.md:539-541`. The verification script repeats the pattern at `scripts/verify_wordpress_mcp.sh:29-32`. ### Technical Analysis Application passwords and bearer tokens passed as process arguments may be exposed through: - Shell history. - Process listings and process monitoring. - Command telemetry or terminal s ...[truncated 1750 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove password and token command-line parameters from recommended usage. 2. Read secrets with `read -r -s` from `/dev/tty`, or accept a restricted secret-file descriptor. 3. Prefer configuration references to environment variables or operating-system secret stores over literal values. 4. Warn users that environment variables may still be exposed to same-user processes on some systems. 5. Parse the URL with a real URL parser and require `https://`. 6. Permit HTTP only behind an explicit development-only flag restricted to loopback addresses. 7. Reject URLs containing credentials, control characters, fragments, or unexpected schemes. 8. Rotate any credentials previously entered into shell history and remove affected history entries. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup_wordpress_mcp.sh:220
• Finding: Unescaped WordPress URL permits TOML configuration injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup_wordpress_mcp.sh:220-242` **Vulnerability Type**: TOML injection into persistent agent configuration **Risk Level**: High ### Vulnerable Code ```python path, remove, do_adapter, do_ae, \ adapter_name, ae_name, adapter_url, ae_url, basic_auth, ae_token = sys.argv[1:11] do_adapter = int(do_adapter); do_ae = int(do_ae) with open(path) as f: content = f.read() blocks = [] if do_adapter and basic_auth: blocks.append(f''' [mcp_servers.{adapter_name}] url = "{adapter_url}" [mcp_servers.{adapter_name}.headers] Authorization = "Basic {basic_auth}" ''') if do_ae and ae_token: blocks.append(f''' [mcp_servers.{ae_name}] url = "{ae_url}" [mcp_servers.{ae_name}.headers] Authorization = "Bearer {ae_token}" ''') with open(path, 'a') as f: for b in blocks: f.write(b) ``` The `adapter_url` and `ae_url` values are derived directly from the user-supplied `--url` argument. ### Technical Analysis The script creates TOML by directly interpolating the URL into a double-quoted string. It does not escape quotation marks, backslashes, newlines, or other TOML syntax. A crafted URL can terminate the intended string and inject arbitrary TOML sections. Codex MCP configuration supports command-based servers, so an injected section could define an additional server whose `command` and `args` launch a local executable. The injected configuration is persistent because it is appended to `~/.codex/config.toml` and is loaded in future agent sessions. ### Attack Path 1. An attacker influences the `--url` value supplied to the setup script. 2. The value contains a quotation mark, newline, and additional TOML sections. 3. The script appends the crafted value without escaping. 4. The resulting Codex configuration defines an attacker-selected command-based MCP server. 5. Codex reloads the configuration during a later session. 6. The attacker-selected command executes with the privileges of the loc ...[truncated 639 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct TOML through string interpolation. 2. Use a maintained TOML parser and serializer to update the configuration structurally. 3. Parse the supplied URL and accept only valid HTTPS URLs. 4. Reject quotation marks, backslashes, newlines, carriage returns, NUL bytes, and other control characters. 5. Restrict hostnames to the user-confirmed WordPress site where practical. 6. Write updates atomically to a temporary file with mode `0600`, validate the result, and then rename it. 7. Detect and replace existing server sections instead of blindly appending duplicate sections. 8. Add tests using malicious URLs containing TOML section and command injection payloads. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/troubleshooting.md:230
• Finding: Troubleshooting commands disclose existing and newly generated bearer tokens<![CDATA[ ## Vulnerability Details **File Location**: `references/troubleshooting.md:230-246` **Vulnerability Type**: Plaintext secret disclosure to terminal and logs **Risk Level**: Medium ### Vulnerable Code ```bash ### Endpoint returns 401 Unauthorized **Cause:** Wrong or missing Bearer Token. **Fix:** Check the stored token and regenerate if needed: ```bash wp eval 'echo get_option("mwai_options")["mcp_bearer_token"];' --path=$WP_PATH --allow-root # If empty or wrong, regenerate: TOKEN=$(openssl rand -hex 24) wp eval ' $o = get_option("mwai_options"); $o["mcp_bearer_token"] = "'"$TOKEN"'"; update_option("mwai_options", $o); ' --path=$WP_PATH --allow-root echo "New token: $TOKEN" ``` ``` ### Technical Analysis The first command prints the existing AI Engine bearer token from the WordPress database. The final command prints the replacement token. This conflicts with the Skill’s own security guidance not to print or log credentials. Terminal output can be retained by CI systems, support tooling, session recorders, shell wrappers, remote administration products, and copied troubleshooting transcripts. A bearer token does not require a second authentication factor and can generally be replayed directly. The command also uses `wp eval`, which executes arbitrary PHP. Although appropriate administrative access is already required, displaying the token is unnecessary for diagnosing an authentication failure. ### Attack Path 1. An administrator follows the troubleshooting instructions. 2. The existing or newly generated token is printed to standard output. 3. A terminal recorder, CI log, support transcript, or nearby observer captures it. 4. The token is used in an `Authorization: Bearer` header against the AI Engine MCP endpoint. 5. The attacker invokes the tools authorized by that token until it is rotated. ### Impact Assessment The attacker obtains the effective privileges exposed by the AI Engine MCP server. The exact scope depends on enabled feature f ...[truncated 434 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all commands that print the existing or replacement token. 2. Generate the token and write it directly to a file created with mode `0600`, or store it in a secret manager. 3. Display only a confirmation message and token fingerprint, such as the first few characters of a SHA-256 digest. 4. Ensure the token file is never committed or included in diagnostic archives. 5. Rotate any token that has already appeared in terminal or CI logs. 6. Prefer a dedicated administrative command or WordPress UI workflow over arbitrary `wp eval`. 7. Add explicit instructions to sanitize logs and support transcripts before sharing them. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (165)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- PHP path: `/www/server/php/<version>/` (e.g. `/www/server/php/85/`)
- Site root: `/www/wwwroot/<domain>/`
- Web user: `www:www`
- WP-CLI may need `--allow-root` and the right PHP binary

```bash
# aaPanel example — run as the web user, not root, when possible

• Confidence: 83% confidence
• Finding: Normalizing `--allow-root` in a skill that already performs plugin installs, option updates, and filesystem actions is dangerous because it suppresses WP-CLI's safety boundary against root execution. If an agent follows this pattern broadly, mistakes or injected paths can have full-system or full-site impact rather than being confined to the web user context.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

curl -fsSL -o /tmp/mcp-adapter.zip "https://github.com/WordPress/mcp-adapter/releases/download/${MCP_ADAPTER_VERSION}/mcp-adapter.zip"
# Verify checksum when a release provides one, then install as the web user
sudo -u www cp /tmp/mcp-adapter.zip "$WP_PATH/wp-content/upgrade/"
sudo -u www wp plugin install "$WP_PATH/wp-content/upgrade/mcp-adapter.zip" --activate --path="$WP_PATH" --allow-root
sudo -u www wp rewrite flush --path="$WP_PATH" --allow-root
```

• Confidence: 90% confidence
• Finding: This line installs a plugin while explicitly permitting root execution, bypassing WP-CLI's defense-in-depth check. In practice, that means an agent could write executable PHP into the site with maximal privileges, magnifying the consequences of any path error, compromised package, or prompt-influenced command construction.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Verify checksum when a release provides one, then install as the web user
sudo -u www cp /tmp/mcp-adapter.zip "$WP_PATH/wp-content/upgrade/"
sudo -u www wp plugin install "$WP_PATH/wp-content/upgrade/mcp-adapter.zip" --activate --path="$WP_PATH" --allow-root
sudo -u www wp rewrite flush --path="$WP_PATH" --allow-root
```

## A.2 Enable Application Passwords

• Confidence: 85% confidence
• Finding: Although `wp rewrite flush` is less dangerous than installation, pairing it with `--allow-root` still weakens execution safeguards and normalizes unsafe defaults. This contributes to a broader privileged-execution anti-pattern in the skill.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# List admin users
wp user list --role=administrator --fields=ID,user_login --allow-root --path="$WP_PATH"

# Create application password for a chosen admin user (replace <USER_ID>)
# The generated password is printed once; capture it securely and do not log it.

• Confidence: 80% confidence
• Finding: Listing admin users with `--allow-root` needlessly performs a sensitive identity enumeration action under elevated trust. In an agent context, this can facilitate subsequent privileged credential creation or user targeting while bypassing built-in safeguards.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Create application password for a chosen admin user (replace <USER_ID>)
# The generated password is printed once; capture it securely and do not log it.
wp user application-password create <USER_ID> "mcp-clients" --allow-root --path="$WP_PATH"
```

> **Store the password securely.** It is shown only once. The full credential for Basic Auth is `base64("username:password")`. Never write the password to the console log, to a committed file, or to an untrusted client.

• Confidence: 93% confidence
• Finding: Creating an application password under `--allow-root` is particularly risky because it generates long-lived API credentials while bypassing WP-CLI's root-safety restriction. If abused, it can grant persistent administrative API access to a WordPress site under the control of an automated agent.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# Use a pinned version (replace <VERSION> with the desired release, e.g. "4.2.0")
AI_ENGINE_VERSION="<VERSION>"
wp plugin install "ai-engine.${AI_ENGINE_VERSION}" --activate --allow-root --path="$WP_PATH"

# If wp plugin install fails (some hosts block remote installs):
# 1. Download manually from https://wordpress.org/plugins/ai-engine/ (specific version)

• Confidence: 91% confidence
• Finding: Installing `ai-engine` with `--allow-root` combines remote package retrieval and plugin activation with elevated execution semantics. Because plugins execute PHP on the server, this materially increases the impact of supply-chain compromise or operator error.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

$o["mcp_bearer_token"] = "'"$TOKEN"'";
update_option("mwai_options", $o);
echo "module_mcp enabled\n";
' --allow-root --path="$WP_PATH"

wp rewrite flush --allow-root --path="$WP_PATH"
```

• Confidence: 94% confidence
• Finding: This line runs `wp eval` with `--allow-root`, which is effectively arbitrary PHP execution with elevated trust on the WordPress host. Even though the example is for enabling a module and setting a token, the pattern is dangerous because any modification or injection would execute server-side code directly.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "module_mcp enabled\n";
' --allow-root --path="$WP_PATH"

wp rewrite flush --allow-root --path="$WP_PATH"
```

> **Store the token securely.** It is the only credential needed for the AI Engine MCP endpoint. Never commit or log it.

• Confidence: 82% confidence
• Finding: Using `--allow-root` for rewrite flushing continues the unsafe privileged-execution model immediately after arbitrary option modification. While the specific command is routine, the pattern reduces safety barriers in a high-trust automation workflow.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# // $o["mcp_feature_seo_engine"] = true;  // SEO (requires SEO Engine)
# // $o["mcp_feature_social_engine"] = true; // Social scheduling (requires Social Engine)
# update_option("mwai_options", $o);
# ' --allow-root --path="$WP_PATH"
```

## B.3 The MCP endpoint

• Confidence: 92% confidence
• Finding: Even though commented, this example encourages enabling highly sensitive AI Engine features via `wp eval ... --allow-root`, including SQL execution and plugin/theme actions. The combination of arbitrary PHP and root-tolerant execution can quickly become a route to full site compromise if copied into practice.

MCP Config Access

High

• Category: Agent Snooping

Content

| Platform | Config file | Root key | URL field | Gotcha |
|----------|-------------|----------|-----------|--------|
| Claude Code | `~/.claude.json` | `mcpServers` | `url` | `type: "http"` |
| Devin CLI | `~/.config/devin/mcp_config.json` | `mcpServers` | `url` | `devin mcp add` CLI |
| OpenCode | `~/.config/opencode/opencode.json` | `mcp` | `url` | `type: "remote"`, `environment` not `env` |
| Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | `httpUrl` | NOT `url`! |
| AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | `httpUrl` | NOT `url`! |

• Confidence: 90% confidence
• Finding: The skill includes detailed MCP configuration locations and schema guidance, which enables automated modification of agent connection settings. In combination with shell/file-write capability, this becomes a real security issue because it can be used to install or alter trusted remote endpoints and auth headers.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

| Claude Code | `~/.claude.json` | `mcpServers` | `url` | `type: "http"` |
| Devin CLI | `~/.config/devin/mcp_config.json` | `mcpServers` | `url` | `devin mcp add` CLI |
| OpenCode | `~/.config/opencode/opencode.json` | `mcp` | `url` | `type: "remote"`, `environment` not `env` |
| Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | `httpUrl` | NOT `url`! |
| AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | `httpUrl` | NOT `url`! |
| Codex | `~/.codex/config.toml` | `[mcp_servers.<name>]` | `url` | Headers in sub-table |
| OpenClaw | `~/.openclaw/openclaw.json` | `mcp.servers` | `url` | `openclaw mcp add` CLI |

• Confidence: 90% confidence
• Finding: The skill provides instructions to access and modify agent configuration files in user home directories, including MCP settings that may contain credentials or trusted server definitions. In an agent environment, writing these files can create persistence, redirect tool traffic, or silently add malicious endpoints.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

| OpenCode | `~/.config/opencode/opencode.json` | `mcp` | `url` | `type: "remote"`, `environment` not `env` |
| Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | `httpUrl` | NOT `url`! |
| AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | `httpUrl` | NOT `url`! |
| Codex | `~/.codex/config.toml` | `[mcp_servers.<name>]` | `url` | Headers in sub-table |
| OpenClaw | `~/.openclaw/openclaw.json` | `mcp.servers` | `url` | `openclaw mcp add` CLI |

> **Top 3 silent-failure traps:**

• Confidence: 90% confidence
• Finding: Referencing and potentially altering `~/.codex/config.toml` exposes a high-value persistence surface for agent behavior and authentication headers. If misused or automated without strict confirmation, this can modify trusted MCP endpoints or inject attacker-controlled configuration.

Self-Modification

High

• Category: Rogue Agent

Content

| mcp-adapter tools/list empty | Missing `Mcp-Session-Id` header | Capture from `initialize` response headers, send in subsequent requests |
| AI Engine endpoint 404 | `module_mcp` is `false` | `wp eval '$o=get_option("mwai_options"); $o["module_mcp"]=true; update_option("mwai_options",$o);'` |
| AI Engine 401 Unauthorized | Wrong or missing Bearer Token | Check `mwai_options.mcp_bearer_token`; re-generate if needed |
| `composer install` fails | Composer < 2.2 (jetpack-autoloader requires ^2.2) | `composer self-update --2` |
| `wp plugin install ai-engine` fails | Host blocks WP.org downloads | Download zip manually, extract, copy to `wp-content/plugins/` |
| MCP config silently ignored (no tools) | Wrong field name for platform | See `references/platform-quirks.md` (httpUrl vs url, mcp vs mcpServers) |
| Gemini CLI MCP not loading | Used `url` instead of `httpUrl` | Gemini uses `httpUrl` for HTTP servers, not `url` |

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Ae1

High

• Category: analysis-evasion

Content

- **`scripts/setup_wordpress_mcp.sh`** — Detects all installed MCP clients and patches each with the correct format.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Exposing SQL execution through MCP is highly dangerous and not justified by a setup/troubleshooting skill. If available to an agent, it can bypass higher-level WordPress permission checks and directly read, modify, or destroy site data, including credentials, tokens, content, and configuration.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The dynamic REST feature can expose arbitrary custom endpoints as MCP tools, significantly expanding the reachable attack surface beyond the stated purpose. This can unintentionally grant agents access to sensitive or unsafe application functionality that was never reviewed for AI-mediated invocation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

// $o["mcp_feature_social_engine"] = true;
// $o["mcp_feature_dynamic_rest"] = true;
update_option("mwai_options", $o);
' --path=$WP_PATH --allow-root
```

---

• Confidence: 88% confidence
• Finding: The documentation includes `wp eval ... --allow-root`, which encourages running a powerful interpreter as root. In practice this can normalize unsafe operational habits, reduce guardrails, and increase the blast radius of mistakes or abuse when modifying WordPress options that control MCP feature exposure.

External Script Fetching

High

• Category: Supply Chain

Content

URL="https://yourdomain.com/wp-json/mcp/v1/http"

# List all available tools (names + descriptions)
curl -s -X POST "$URL" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

wp eval 'echo wp_is_application_passwords_available() ? "enabled" : "disabled";' --path=$WP_PATH --allow-root

# Create application password
wp user application-password create 1 "mcp-clients" --path=$WP_PATH --allow-root
# Output: Password: xxxx xxxx xxxx xxxx xxxx xxxx

# Generate Basic Auth value

• Confidence: 74% confidence
• Finding: The documentation creates an application password for user ID 1 with --allow-root, and the surrounding examples imply using the admin account for MCP access. In the context of exposing WordPress abilities remotely, encouraging credentials tied to a highly privileged account amplifies the impact of any secret leakage or misuse, potentially granting broad administrative access through Basic Auth.

MCP Config Access

High

• Category: Agent Snooping

Content

| Command | Description |
|---------|-------------|
| `wp mcp-adapter serve [--server=<id>] [--user=<user>]` | Serve MCP server via STDIO |
| `wp mcp-adapter list [--format=<format>]` | List all MCP servers |

### Examples

• Confidence: 80% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

MCP Config Access

High

• Category: Agent Snooping

Content

| Platform | Config file | Root key | Remote URL field | Auth field | Transport marker |
|----------|-------------|----------|------------------|------------|------------------|
| Claude Code | `~/.claude.json` | `mcpServers` | `url` | `headers` | `type: "http"` |
| Devin CLI | `~/.config/devin/mcp_config.json` | `mcpServers` | `url` | `headers` | — (HTTP auto-detected) |
| OpenCode | `~/.config/opencode/opencode.json` | **`mcp`** | `url` | `headers` | `type: "remote"` |
| Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — |
| AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — |

• Confidence: 90% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

MCP Config Access

High

• Category: Agent Snooping

Content

| Platform | Config file | Root key | Remote URL field | Auth field | Transport marker |
|----------|-------------|----------|------------------|------------|------------------|
| Claude Code | `~/.claude.json` | `mcpServers` | `url` | `headers` | `type: "http"` |
| Devin CLI | `~/.config/devin/mcp_config.json` | `mcpServers` | `url` | `headers` | — (HTTP auto-detected) |
| OpenCode | `~/.config/opencode/opencode.json` | **`mcp`** | `url` | `headers` | `type: "remote"` |
| Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — |
| AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — |

• Confidence: 90% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

| Claude Code | `~/.claude.json` | `mcpServers` | `url` | `headers` | `type: "http"` |
| Devin CLI | `~/.config/devin/mcp_config.json` | `mcpServers` | `url` | `headers` | — (HTTP auto-detected) |
| OpenCode | `~/.config/opencode/opencode.json` | **`mcp`** | `url` | `headers` | `type: "remote"` |
| Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — |
| AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — |
| Codex | `~/.codex/config.toml` | `[mcp_servers.<name>]` | `url` | **sub-table `headers`** | — |
| OpenClaw | `~/.openclaw/openclaw.json` | `mcp.servers` | `url` | `--header` flag | `transport: "streamable-http"` |

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

| Claude Code | `~/.claude.json` | `mcpServers` | `url` | `headers` | `type: "http"` |
| Devin CLI | `~/.config/devin/mcp_config.json` | `mcpServers` | `url` | `headers` | — (HTTP auto-detected) |
| OpenCode | `~/.config/opencode/opencode.json` | **`mcp`** | `url` | `headers` | `type: "remote"` |
| Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — |
| AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — |
| Codex | `~/.codex/config.toml` | `[mcp_servers.<name>]` | `url` | **sub-table `headers`** | — |
| OpenClaw | `~/.openclaw/openclaw.json` | `mcp.servers` | `url` | `--header` flag | `transport: "streamable-http"` |

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

| Claude Code | `~/.claude.json` | `mcpServers` | `url` | `headers` | `type: "http"` |
| Devin CLI | `~/.config/devin/mcp_config.json` | `mcpServers` | `url` | `headers` | — (HTTP auto-detected) |
| OpenCode | `~/.config/opencode/opencode.json` | **`mcp`** | `url` | `headers` | `type: "remote"` |
| Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — |
| AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — |
| Codex | `~/.codex/config.toml` | `[mcp_servers.<name>]` | `url` | **sub-table `headers`** | — |
| OpenClaw | `~/.openclaw/openclaw.json` | `mcp.servers` | `url` | `--header` flag | `transport: "streamable-http"` |

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/mcp-config.md:325