Security audit

WordPress API Pro

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed WordPress administration toolkit that can change live site content, but its sensitive behavior is consistent with its stated purpose and documented safety expectations.

Install only if you intend to let an agent administer WordPress sites. Use a dedicated low-privilege WordPress user or WooCommerce key, prefer HTTPS, keep credentials in environment variables or a protected local config, run batch and seed operations in dry-run first, and set WP_REQUIRE_ALLOWLIST=1 if you want SEO updates limited to known Rank Math or Yoast fields.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The tool accepts non-allowlisted keys in the user-supplied SEO meta JSON and writes them directly into the WordPress postmeta payload. In this skill’s context, that expands a narrowly scoped SEO editor into a generic arbitrary postmeta writer, which can modify unrelated plugin settings or hidden metadata on a live site if the caller supplies crafted keys.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The comment suggests non-allowlisted keys are only 'surfaced,' but the implementation both warns and includes them in the outbound payload by default. That mismatch is security-relevant because operators may believe the tool is constrained to SEO fields when it will actually perform broader metadata modification on remote content.

Missing User Warnings

Medium

Confidence: 77% confidence
Finding: The reference documents a destructive `DELETE /posts/{id}` operation with no inline caution about irreversible content deletion, approval requirements, or draft-first workflow. In an agent skill context, terse API docs can directly shape tool use, increasing the chance of accidental destructive actions against a live WordPress site.

Missing User Warnings

Low

Confidence: 71% confidence
Finding: The authentication section lists Application Passwords, OAuth, and Basic Authentication without warning that these credentials are secrets that must not be logged, echoed, or stored insecurely. In an agent-integrated skill, omission of credential-handling guidance can lead to leakage through prompts, transcripts, debug output, or unsafe plugin choices such as Basic Auth.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: When --set is provided, the script proceeds directly to detect a plugin and write metadata to the remote WordPress post without any execution-time confirmation or dry-run safeguard. Because this skill is designed for live site administration, missing a final confirmation increases the chance of accidental or unauthorized changes to production content.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.