Wordpress OAuth

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:16 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but it stores and handles WordPress OAuth secrets in ways that could leak them, so users should review it carefully before installing.

Install only if you are comfortable with this skill storing a reusable WordPress bearer token in its own directory and using it to create or publish posts. Prefer the smallest OAuth scope and draft status, keep the skill directory private, avoid running the secret-bearing commands in logged shells or CI, and revoke the WordPress token if credentials.json or command logs may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: wp_oauth_skill.py:148

Finding

OAuth Secrets Exposed Through Process Command-Line Arguments

Content

View full analysis

dict[str, Any]: client_id = get_required(args.client_id, "WPCOM_CLIENT_ID", "--client-id") client_secret = get_required( args.client_secret, "WPCOM_CLIENT_SECRET", "--client-secret" ) redirect_uri = get_required( args.redirect_uri, "WPCOM_REDIRECT_URI", "--redirect-uri" ) code = args.code callback_state = args.state if args.callback_url: parsed_code, parsed_state, oauth_error = parse_callback(args.callback_url) ``` ```python p_exchange.add_argument("--client-id", default=None) p_exchange.add_argument("--client-secret", default=None) p_exchange.add_argument("--redirect-uri", default=None) p_exchange.add_argument("--callback-url", default=None) p_exchange.add_argument("--code", default=None) p_exchange.add_argument("--state", default=None) ``` The documented command encourages supplying these values as command-line arguments: ```bash python3 {baseDir}/wp_oauth_skill.py exchange-token \ --client-id "$WPCOM_CLIENT_ID" \ --client-secret "$WPCOM_CLIENT_SECRET" \ --redirect-uri "$WPCOM_REDIRECT_URI" \ --callback-url "https://example/callback?code=...&state=..." ``` ### Technical Analysis The OAuth client secret, authorization code, and complete callback URL are accepted through command-line flags. Shell variable expansion occurs before process creation, so the expanded values can appear in the Python process argument vector. Depending on the operating system and execution environment, command-line arguments may be exposed through process-monitoring interfaces, diagnostic tooling, shell tracing, terminal or session recording, job-runner logs, and command-history workflows. ...[truncated 2128 chars]

Remediation

View remediation

str: resolved = value or os.environ.get(env_name) if resolved: return resolved raise SkillError( f"Missing required value. Provide {flag_name} or set {env_name}." ) ``` 2. Prefer reading the client secret from a protected environment variable, standard input, a secret manager, or `getpass.getpass()` instead of a command-line option. 3. Allow the callback URL or authorization code to be supplied through standard input or a protected file descriptor. 4. Update `SKILL.md` so the recommended command does not include secret-bearing flags. 5. Retain command-line secret options only if compatibility requires them, and display an explicit warning that process arguments may be logged or visible locally. 6. Ensure CI systems and process supervisors do not log expanded commands or environment variables containing OAuth material. 7. Clear temporary references to authorization codes and avoid including them in errors or debug output. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: wp_oauth_skill.py:212

Finding

Bearer Access Token Included in Token-Info URL Query String

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: wordpress-oauth
description: Start and complete WordPress.com OAuth and publish posts through the WordPress.com REST API. Use when you need to generate an authorization URL, exchange callback code for an access token, validate token health, or publish draft/published posts to a WordPress.com or Jetpack-connected site.
---

# WordPress OAuth Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · wp_oauth_skill.py (reported line 293)May include surrounding context.

python

---
name: wordpress-oauth
description: Start and complete WordPress.com OAuth and publish posts through the WordPress.com REST API. Use when you need to generate an authorization URL, exchange callback code for an access token, validate token health, or publish draft/published posts to a WordPress.com or Jetpack-connected site.
---

# WordPress OAuth Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The skill explicitly documents a local credential store inside the skill directory, which means bearer tokens and related secrets are persisted on disk in a likely predictable location. Stored OAuth credentials are highly sensitive; if the directory is readable by other agents, users, backups, or logs, an attacker could reuse the token to access or publish to the connected WordPress site.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

- Script: `{baseDir}/wp_oauth_skill.py`
- OAuth state store: `{baseDir}/oauth_state.json`
- Credential store: `{baseDir}/credentials.json`

This skill stores state and credentials in files inside this skill directory.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This step states that exchanged OAuth credentials are written to credentials.json, confirming persistent on-disk storage of access material after the callback flow. Persistent bearer tokens materially increase compromise impact because anyone obtaining the file can authenticate to the WordPress API without needing the user's password or another approval step.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

--callback-url "https://example/callback?code=...&state=..."

text

Validates CSRF `state`, exchanges code for token, and writes credentials to `{baseDir}/credentials.json`.

### 3) Token Info

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

BASE_DIR = Path(__file__).resolve().parent
STATE_PATH = BASE_DIR / "oauth_state.json"
CREDS_PATH = BASE_DIR / "credentials.json"


class SkillError(Exception):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · wp_oauth_skill.py (reported line 31)May include surrounding context.

python

BASE_DIR = Path(__file__).resolve().parent
STATE_PATH = BASE_DIR / "oauth_state.json"
CREDS_PATH = BASE_DIR / "credentials.json"


class SkillError(Exception):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documentation exposes capabilities requiring file read/write, network access, and shell execution, but it does not declare any explicit tool scope or permissions boundary. That omission increases risk because consumers or orchestration layers may permit broader access than necessary, making credential handling and remote publishing operations less constrained.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill persists the OAuth access token in a local JSON file on disk, which creates a recoverable secret at rest in the workspace. Although the file permissions are restricted with chmod(0o600), that protection is best-effort only and may not be enforced on all platforms or against other processes/users with access to the workspace, so compromise of the directory exposes the token for API use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.