Security audit
Security checks for vulnerabilities and agentic risk
This is a mostly coherent WordPress/Flatsome site-building skill, but it gives admin-level WP-CLI instructions including irreversible page deletion without clear safeguards.
Review before installing if you will let an agent run WP-CLI commands. Use backups and staging, confirm the target WordPress path and post IDs, prefer trashing posts over `--force`, and approve plugin installs, theme changes, and published-content changes explicitly.
The heading and all operational instructions are presented in Vietnamese for 'mọi AI Agent', implying a fixed language behavior rather than a user-selected locale. There is no statement that the skill is Vietnam-specific or that users may choose another language.
The documentation explicitly states that output must avoid raw HTML, yet the contact/map example later uses a [ux_html] block containing a literal . This is an active contradiction between the stated implementation rule and the provided implementation pattern, not merely an omitted detail.
The skill includes a force-delete command (wp post delete PAGE_ID --force) with no confirmation, backup, scope validation, or warning. In an agent-execution context, this can lead to irreversible content loss from accidental misuse, bad variable substitution, or unsafe automation paths.
The handoff checklist asserts a strict no-raw-HTML requirement, but earlier examples include raw HTML inside shortcode wrappers, such as the Google Maps iframe and CF7 form content wrapped in div tags. That creates a direct contradiction between the documented acceptance criteria and the actual recommended implementation.
No suspicious patterns detected.
