Security audit

wordpress-mcp

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent WordPress MCP setup purpose, but its scripts and references handle credentials, agent configuration, and remote plugin installs in ways that require careful review before use.

Install only if you are comfortable reviewing and manually controlling the high-trust steps. Use dry-run first, pin exact plugin and npm versions, require checksums, use HTTPS only, avoid passing secrets on command lines, prefer least-privileged WordPress service accounts, and review any changes to local MCP client configuration before restarting agents.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T08 · Insecure Dependencies

Error

Location: references/mcp-adapter-guide.md:27
Finding: Mutable GitHub releases and development branches are installed as executable WordPress plugins
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/mcp-adapter-guide.md:197
Finding: Unpinned npm proxy is automatically downloaded and executed with WordPress credentials
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/install_wp_plugin.sh:127
Finding: Plugin installer treats a missing checksum as successful verification
Content: View full analysis
&2 return 1 fi echo " checksum OK" } if [ "$PLUGIN" = "mcp-adapter" ]; then echo "=== Installing mcp-adapter $VERSION (official WordPress) ===" if [ -d "$PLUGINS_DIR/mcp-adapter" ] && $WP plugin is-active mcp-adapter 2>/dev/null; then echo "mcp-adapter is already installed and active." exit 0 fi RELEASE_TAG="$VERSION" DOWNLOAD_URL="https://github.com/WordPress/mcp-adapter/releases/download/${RELEASE_TAG}/mcp-adapter.zip" echo "→ Downloading mcp-adapter ${RELEASE_TAG}..." if ! curl -fsSL -o "$TMPDIR/mcp-adapter.zip" "$DOWNLOAD_URL"; then echo "Error: failed to download mcp-adapter ${RELEASE_TAG} from ${DOWNLOAD_URL}" >&2 exit 3 fi verify_checksum "$TMPDIR/mcp-adapter.zip" || exit 6 echo "→ Extracting..." unzip -q "$TMPDIR/mcp-adapter.zip" -d "$TMPDIR/extract" SRC=$(find "$TMPDIR/extract" -maxdepth 1 -type d -name 'mcp-adapter*' | head -n 1) if [ -z "$SRC" ]; then echo "Error: extracted folder not found" >&2 exit 3 fi $SUDO rm -rf "$PLUGINS_DIR/mcp-adapter" $SUDO cp -r "$SRC" "$PLUGINS_DIR/mcp-adapter" $SUDO chown -R "${WEB_USER}:${WEB_USER}" "$PLUGINS_DIR/mcp-adapter" echo "→ Activating plugin..." $WP plugin activate mcp-adapter || { echo "Error: activation failed" >&2; exit 4; } ``` The same optional verification routine is used for the AI Engine download at `scripts/install_w ...[truncated 1542 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup_wordpress_mcp.sh:39
Finding: WordPress credentials are accepted as command-line arguments and may be sent over unencrypted HTTP
Content: View full analysis
&2; exit 64 ;; esac done if [ "$REMOVE" -eq 0 ] && [ -z "$WP_URL" ]; then echo "Error: --url is required (e.g. --url https://yourdomain.com)" >&2 exit 1 fi if [ "$REMOVE" -eq 0 ] && [ "$DO_ADAPTER" -eq 1 ]; then if [ -z "$WP_USER" ] || [ -z "$WP_PASS" ]; then printf 'Enter WordPress username: '; read -r WP_USER printf 'Enter Application Password: '; read -r WP_PASS fi fi if [ "$REMOVE" -eq 0 ] && [ "$DO_AI_ENGINE" -eq 1 ] && [ -z "$AE_TOKEN" ]; then printf 'Enter AI Engine Bearer Token: '; read -r AE_TOKEN fi ADAPTER_URL="${WP_URL%/}${MCP_ADAPTER_PATH}" AI_ENGINE_URL="${WP_URL%/}${AI_ENGINE_PATH}" BASIC_AUTH="" if [ "$DO_ADAPTER" -eq 1 ] && [ -n "$WP_USER" ] && [ -n "$WP_PASS" ]; then BASIC_AUTH=$(echo -n "${WP_USER}:${WP_PASS}" | base64) fi ``` The documentation explicitly encourages command-line secret arguments at `SKILL.md:495-502` and `SKILL.md:539-541`. The verification script repeats the pattern at `scripts/verify_wordpress_mcp.sh:29-32`. ### Technical Analysis Application passwords and bearer tokens passed as process arguments may be exposed through: - Shell history. - Process listings and process monitoring. - Command telemetry or terminal s ...[truncated 1750 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup_wordpress_mcp.sh:220
Finding: Unescaped WordPress URL permits TOML configuration injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/troubleshooting.md:230
Finding: Troubleshooting commands disclose existing and newly generated bearer tokens
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (165)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 83% confidence
Finding: Normalizing --allow-root in a skill that already performs plugin installs, option updates, and filesystem actions is dangerous because it suppresses WP-CLI's safety boundary against root execution. If an agent follows this pattern broadly, mistakes or injected paths can have full-system or full-site impact rather than being confined to the web user context.
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

PHP path: /www/server/php/<version>/ (e.g. /www/server/php/85/)

Site root: /www/wwwroot/<domain>/

Web user: www:www

WP-CLI may need --allow-root and the right PHP binary

bash
# aaPanel example — run as the web user, not root, when possible

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: This line installs a plugin while explicitly permitting root execution, bypassing WP-CLI's defense-in-depth check. In practice, that means an agent could write executable PHP into the site with maximal privileges, magnifying the consequences of any path error, compromised package, or prompt-influenced command construction.
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
curl -fsSL -o /tmp/mcp-adapter.zip "https://github.com/WordPress/mcp-adapter/releases/download/${MCP_ADAPTER_VERSION}/mcp-adapter.zip"

Verify checksum when a release provides one, then install as the web user

sudo -u www cp /tmp/mcp-adapter.zip "$WP_PATH/wp-content/upgrade/" sudo -u www wp plugin install "$WP_PATH/wp-content/upgrade/mcp-adapter.zip" --activate --path="$WP_PATH" --allow-root sudo -u www wp rewrite flush --path="$WP_PATH" --allow-root

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Although wp rewrite flush is less dangerous than installation, pairing it with --allow-root still weakens execution safeguards and normalizes unsafe defaults. This contributes to a broader privileged-execution anti-pattern in the skill.
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
Verify checksum when a release provides one, then install as the web user

sudo -u www cp /tmp/mcp-adapter.zip "$WP_PATH/wp-content/upgrade/" sudo -u www wp plugin install "$WP_PATH/wp-content/upgrade/mcp-adapter.zip" --activate --path="$WP_PATH" --allow-root sudo -u www wp rewrite flush --path="$WP_PATH" --allow-root

text
## A.2 Enable Application Passwords

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Listing admin users with --allow-root needlessly performs a sensitive identity enumeration action under elevated trust. In an agent context, this can facilitate subsequent privileged credential creation or user targeting while bypassing built-in safeguards.
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
bash
# List admin users wp user list --role=administrator --fields=ID,user_login --allow-root --path="$WP_PATH" # Create application password for a chosen admin user (replace <USER_ID>) # The generated password is printed once; capture it securely and do not log it.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: Creating an application password under --allow-root is particularly risky because it generates long-lived API credentials while bypassing WP-CLI's root-safety restriction. If abused, it can grant persistent administrative API access to a WordPress site under the control of an automated agent.
Content: Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.
Create application password for a chosen admin user (replace <USER_ID>)

The generated password is printed once; capture it securely and do not log it.

wp user application-password create <USER_ID> "mcp-clients" --allow-root --path="$WP_PATH"

text
> **Store the password securely.** It is shown only once. The full credential for Basic Auth is `base64("username:password")`. Never write the password to the console log, to a committed file, or to an untrusted client.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 91% confidence
Finding: Installing ai-engine with --allow-root combines remote package retrieval and plugin activation with elevated execution semantics. Because plugins execute PHP on the server, this materially increases the impact of supply-chain compromise or operator error.
Content: Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.
bash
# Use a pinned version (replace <VERSION> with the desired release, e.g. "4.2.0") AI_ENGINE_VERSION="<VERSION>" wp plugin install "ai-engine.${AI_ENGINE_VERSION}" --activate --allow-root --path="$WP_PATH" # If wp plugin install fails (some hosts block remote installs): # 1. Download manually from https://wordpress.org/plugins/ai-engine/ (specific version)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: This line runs wp eval with --allow-root, which is effectively arbitrary PHP execution with elevated trust on the WordPress host. Even though the example is for enabling a module and setting a token, the pattern is dangerous because any modification or injection would execute server-side code directly.
Content: Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.
$o["mcp_bearer_token"] = "'"$TOKEN"'"; update_option("mwai_options", $o); echo "module_mcp enabled\n"; ' --allow-root --path="$WP_PATH"

wp rewrite flush --allow-root --path="$WP_PATH"

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 82% confidence
Finding: Using --allow-root for rewrite flushing continues the unsafe privileged-execution model immediately after arbitrary option modification. While the specific command is routine, the pattern reduces safety barriers in a high-trust automation workflow.
Content: Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.
echo "module_mcp enabled\n"; ' --allow-root --path="$WP_PATH"

wp rewrite flush --allow-root --path="$WP_PATH"

text
> **Store the token securely.** It is the only credential needed for the AI Engine MCP endpoint. Never commit or log it.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 92% confidence
Finding: Even though commented, this example encourages enabling highly sensitive AI Engine features via wp eval ... --allow-root, including SQL execution and plugin/theme actions. The combination of arbitrary PHP and root-tolerant execution can quickly become a route to full site compromise if copied into practice.
Content: Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.
// $o["mcp_feature_seo_engine"] = true; // SEO (requires SEO Engine)

// $o["mcp_feature_social_engine"] = true; // Social scheduling (requires Social Engine)

update_option("mwai_options", $o);

' --allow-root --path="$WP_PATH"

text
## B.3 The MCP endpoint

MCP Config Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: The skill includes detailed MCP configuration locations and schema guidance, which enables automated modification of agent connection settings. In combination with shell/file-write capability, this becomes a real security issue because it can be used to install or alter trusted remote endpoints and auth headers.
Content: Scanner excerpt · SKILL.md (reported line 521)May include surrounding context.
md
| Platform | Config file | Root key | URL field | Gotcha | |----------|-------------|----------|-----------|--------| | Claude Code | `~/.claude.json` | `mcpServers` | `url` | `type: "http"` | | Devin CLI | `~/.config/devin/mcp_config.json` | `mcpServers` | `url` | `devin mcp add` CLI | | OpenCode | `~/.config/opencode/opencode.json` | `mcp` | `url` | `type: "remote"`, `environment` not `env` | | Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | `httpUrl` | NOT `url`! | | AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | `httpUrl` | NOT `url`! |

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: The skill provides instructions to access and modify agent configuration files in user home directories, including MCP settings that may contain credentials or trusted server definitions. In an agent environment, writing these files can create persistence, redirect tool traffic, or silently add malicious endpoints.
Content: Scanner excerpt · SKILL.md (reported line 523)May include surrounding context.
md
| Claude Code | `~/.claude.json` | `mcpServers` | `url` | `type: "http"` | | Devin CLI | `~/.config/devin/mcp_config.json` | `mcpServers` | `url` | `devin mcp add` CLI | | OpenCode | `~/.config/opencode/opencode.json` | `mcp` | `url` | `type: "remote"`, `environment` not `env` | | Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | `httpUrl` | NOT `url`! | | AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | `httpUrl` | NOT `url`! | | Codex | `~/.codex/config.toml` | `[mcp_servers.<name>]` | `url` | Headers in sub-table | | OpenClaw | `~/.openclaw/openclaw.json` | `mcp.servers` | `url` | `openclaw mcp add` CLI |

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Referencing and potentially altering ~/.codex/config.toml exposes a high-value persistence surface for agent behavior and authentication headers. If misused or automated without strict confirmation, this can modify trusted MCP endpoints or inject attacker-controlled configuration.
Content: Scanner excerpt · SKILL.md (reported line 525)May include surrounding context.
md
| OpenCode | `~/.config/opencode/opencode.json` | `mcp` | `url` | `type: "remote"`, `environment` not `env` | | Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | `httpUrl` | NOT `url`! | | AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | `httpUrl` | NOT `url`! | | Codex | `~/.codex/config.toml` | `[mcp_servers.<name>]` | `url` | Headers in sub-table | | OpenClaw | `~/.openclaw/openclaw.json` | `mcp.servers` | `url` | `openclaw mcp add` CLI | > **Top 3 silent-failure traps:**

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 615)May include surrounding context.
md
| mcp-adapter tools/list empty | Missing `Mcp-Session-Id` header | Capture from `initialize` response headers, send in subsequent requests | | AI Engine endpoint 404 | `module_mcp` is `false` | `wp eval '$o=get_option("mwai_options"); $o["module_mcp"]=true; update_option("mwai_options",$o);'` | | AI Engine 401 Unauthorized | Wrong or missing Bearer Token | Check `mwai_options.mcp_bearer_token`; re-generate if needed | | `composer install` fails | Composer < 2.2 (jetpack-autoloader requires ^2.2) | `composer self-update --2` | | `wp plugin install ai-engine` fails | Host blocks WP.org downloads | Download zip manually, extract, copy to `wp-content/plugins/` | | MCP config silently ignored (no tools) | Wrong field name for platform | See `references/platform-quirks.md` (httpUrl vs url, mcp vs mcpServers) | | Gemini CLI MCP not loading | Used `url` instead of `httpUrl` | Gemini uses `httpUrl` for HTTP servers, not `url` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 771)May include surrounding context.
md
- **`scripts/setup_wordpress_mcp.sh`** — Detects all installed MCP clients and patches each with the correct format.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Exposing SQL execution through MCP is highly dangerous and not justified by a setup/troubleshooting skill. If available to an agent, it can bypass higher-level WordPress permission checks and directly read, modify, or destroy site data, including credentials, tokens, content, and configuration.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The dynamic REST feature can expose arbitrary custom endpoints as MCP tools, significantly expanding the reachable attack surface beyond the stated purpose. This can unintentionally grant agents access to sensitive or unsafe application functionality that was never reviewed for AI-mediated invocation.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 88% confidence
Finding: The documentation includes wp eval ... --allow-root, which encourages running a powerful interpreter as root. In practice this can normalize unsafe operational habits, reduce guardrails, and increase the blast radius of mistakes or abuse when modifying WordPress options that control MCP feature exposure.
Content: Scanner excerpt · references/ai-engine-tools.md (reported line 202)May include surrounding context.
// $o["mcp_feature_social_engine"] = true; // $o["mcp_feature_dynamic_rest"] = true; update_option("mwai_options", $o); ' --path=$WP_PATH --allow-root

text
---

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/ai-engine-tools.md (reported line 214)May include surrounding context.
md
URL="https://yourdomain.com/wp-json/mcp/v1/http" # List all available tools (names + descriptions) curl -s -X POST "$URL" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 74% confidence
Finding: The documentation creates an application password for user ID 1 with --allow-root, and the surrounding examples imply using the admin account for MCP access. In the context of exposing WordPress abilities remotely, encouraging credentials tied to a highly privileged account amplifies the impact of any secret leakage or misuse, potentially granting broad administrative access through Basic Auth.
Content: Scanner excerpt · references/mcp-adapter-guide.md (reported line 96)May include surrounding context.
md
wp eval 'echo wp_is_application_passwords_available() ? "enabled" : "disabled";' --path=$WP_PATH --allow-root # Create application password wp user application-password create 1 "mcp-clients" --path=$WP_PATH --allow-root # Output: Password: xxxx xxxx xxxx xxxx xxxx xxxx # Generate Basic Auth value

MCP Config Access

High

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
Content: Scanner excerpt · references/mcp-adapter-guide.md (reported line 340)May include surrounding context.
md
| Command | Description | |---------|-------------| | `wp mcp-adapter serve [--server=<id>] [--user=<user>]` | Serve MCP server via STDIO | | `wp mcp-adapter list [--format=<format>]` | List all MCP servers | ### Examples

MCP Config Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
Content: Scanner excerpt · references/mcp-config.md (reported line 18)May include surrounding context.
md
| Platform | Config file | Root key | Remote URL field | Auth field | Transport marker | |----------|-------------|----------|------------------|------------|------------------| | Claude Code | `~/.claude.json` | `mcpServers` | `url` | `headers` | `type: "http"` | | Devin CLI | `~/.config/devin/mcp_config.json` | `mcpServers` | `url` | `headers` | — (HTTP auto-detected) | | OpenCode | `~/.config/opencode/opencode.json` | **`mcp`** | `url` | `headers` | `type: "remote"` | | Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — | | AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — |

MCP Config Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
Content: Scanner excerpt · references/platform-quirks.md (reported line 10)May include surrounding context.
md
| Platform | Config file | Root key | Remote URL field | Auth field | Transport marker | |----------|-------------|----------|------------------|------------|------------------| | Claude Code | `~/.claude.json` | `mcpServers` | `url` | `headers` | `type: "http"` | | Devin CLI | `~/.config/devin/mcp_config.json` | `mcpServers` | `url` | `headers` | — (HTTP auto-detected) | | OpenCode | `~/.config/opencode/opencode.json` | **`mcp`** | `url` | `headers` | `type: "remote"` | | Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — | | AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — |

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/mcp-config.md (reported line 20)May include surrounding context.
md
| Claude Code | `~/.claude.json` | `mcpServers` | `url` | `headers` | `type: "http"` | | Devin CLI | `~/.config/devin/mcp_config.json` | `mcpServers` | `url` | `headers` | — (HTTP auto-detected) | | OpenCode | `~/.config/opencode/opencode.json` | **`mcp`** | `url` | `headers` | `type: "remote"` | | Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — | | AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — | | Codex | `~/.codex/config.toml` | `[mcp_servers.<name>]` | `url` | **sub-table `headers`** | — | | OpenClaw | `~/.openclaw/openclaw.json` | `mcp.servers` | `url` | `--header` flag | `transport: "streamable-http"` |

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/mcp-config.md (reported line 147)May include surrounding context.
md
| Claude Code | `~/.claude.json` | `mcpServers` | `url` | `headers` | `type: "http"` | | Devin CLI | `~/.config/devin/mcp_config.json` | `mcpServers` | `url` | `headers` | — (HTTP auto-detected) | | OpenCode | `~/.config/opencode/opencode.json` | **`mcp`** | `url` | `headers` | `type: "remote"` | | Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — | | AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — | | Codex | `~/.codex/config.toml` | `[mcp_servers.<name>]` | `url` | **sub-table `headers`** | — | | OpenClaw | `~/.openclaw/openclaw.json` | `mcp.servers` | `url` | `--header` flag | `transport: "streamable-http"` |

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/platform-quirks.md (reported line 12)May include surrounding context.
md
| Claude Code | `~/.claude.json` | `mcpServers` | `url` | `headers` | `type: "http"` | | Devin CLI | `~/.config/devin/mcp_config.json` | `mcpServers` | `url` | `headers` | — (HTTP auto-detected) | | OpenCode | `~/.config/opencode/opencode.json` | **`mcp`** | `url` | `headers` | `type: "remote"` | | Gemini CLI | `~/.gemini/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — | | AGY | `~/.gemini/antigravity-cli/settings.json` | `mcpServers` | **`httpUrl`** | `headers` | — | | Codex | `~/.codex/config.toml` | `[mcp_servers.<name>]` | `url` | **sub-table `headers`** | — | | OpenClaw | `~/.openclaw/openclaw.json` | `mcp.servers` | `url` | `--header` flag | `transport: "streamable-http"` |

Overview

A.I.G

T08 · Insecure Dependencies

T08 · Insecure Dependencies

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Verify checksum when a release provides one, then install as the web user

Tool Parameter Abuse

Verify checksum when a release provides one, then install as the web user

Tool Parameter Abuse

Tool Parameter Abuse

Create application password for a chosen admin user (replace <USER_ID>)

The generated password is printed once; capture it securely and do not log it.

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

// $o["mcp_feature_seo_engine"] = true; // SEO (requires SEO Engine)

// $o["mcp_feature_social_engine"] = true; // Social scheduling (requires Social Engine)

update_option("mwai_options", $o);

' --allow-root --path="$WP_PATH"

MCP Config Access

Agent Config Directory Access

Agent Config Directory Access

Self-Modification

Ae1

Context-Inappropriate Capability

Context-Inappropriate Capability

Tool Parameter Abuse

External Script Fetching

Tool Parameter Abuse

MCP Config Access

MCP Config Access

MCP Config Access

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access