WordPress Publisher Skill

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:00 AM UTC
• Version: 0.1.0

Overview

This skill is a real WordPress publishing helper, but it can change a live site and exposes credentials in ways users should review carefully.

Install only for WordPress sites you control. Use a least-privilege WordPress application password, avoid passing it directly on the command line, verify the site URL, default to draft/preview, and require explicit confirmation before publishing, updating, deleting, uploading media, or creating categories and tags.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly performs network operations against WordPress and references local script files, yet it declares no permissions or capability boundaries. This reduces transparency and can cause the agent or user to invoke a skill with live site modification and file access behavior they were not clearly warned about.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: A description-behavior mismatch is dangerous because users may consent to a narrower publishing workflow while underlying code can also upload media, list content, retrieve media, delete posts, and manipulate pages. Hidden or under-documented destructive and data-access capabilities increase the risk of unauthorized content changes, data exposure, or accidental deletion on a live website.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The marketplace description explicitly promotes direct publishing to WordPress via REST API but does not warn that user content will be transmitted to a remote site and may be published live. In a skill whose core purpose is remote content publication, lack of clear disclosure increases the risk of unintended external data transfer or accidental posting, especially when users may assume local formatting assistance rather than live publication behavior.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Broad invocation phrases can cause the skill to trigger on common publishing or blogging requests without the user fully realizing it may connect to a live WordPress site and perform remote actions. In this context, overbroad routing increases the chance of unintended activation of a state-changing skill tied to sensitive credentials.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The description does not prominently warn that the skill can publish directly to a live website, create drafts, schedule posts, and otherwise alter production content. Missing upfront disclosure is risky because users may provide content or credentials without understanding that the skill is capable of immediate external side effects.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill asks for WordPress username and application password but does not include a clear privacy and handling warning for sensitive authentication data. Because these credentials grant direct API access to a live site, poor disclosure or handling could lead to account misuse, unauthorized publishing, or compromise of site content.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The CLI requires an application password via the --password argument, which exposes the secret to shell history, process listings, and potentially audit logs or job runners. Because this skill is specifically designed to authenticate to a live WordPress site and may use editor/administrator credentials, accidental disclosure can directly enable unauthorized publishing or site content modification.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# WordPress Publisher Skill - Production Dependencies
# Install with: pip install -r requirements.txt

requests>=2.25.0

• Confidence: 95% confidence
• Finding: requests>=2.25.0

Known Vulnerable Dependency: pytest==7.0.0 — 2 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)

High

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: pytest==7.0.0

Known Vulnerable Dependency: black==23.0.0 — 3 advisory(ies): CVE-2026-32274 (Black: Arbitrary file writes from unsanitized user input in cache file name); CVE-2024-21503 (Black vulnerable to Regular Expression Denial of Service (ReDoS)); CVE-2024-21503 (Versions of the package black before 24.3.0 are vulnerable to Regular Expression)

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: black==23.0.0

Known Vulnerable Dependency: python-dotenv==1.0.0 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 79% confidence
• Finding: python-dotenv==1.0.0

Known Vulnerable Dependency: ipython==8.0.0 — 4 advisory(ies): CVE-2023-24816 (IPython vulnerable to command injection via set_term_title); CVE-2022-21699 (Execution with Unnecessary Privileges in ipython); CVE-2022-21699 (IPython (Interactive Python) is a command shell for interactive computing in mul) +1 more

High

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: ipython==8.0.0

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.