WordPress Security Scanner

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:27 PM UTC
• Version:
  1.0.0

Overview

This is a disclosed WordPress security scanning skill, but users should only scan sites they own or are authorized to test.

Install only if you are comfortable sending target site URLs to the external scanning provider. Use it only on WordPress sites you own, administer, or have explicit permission to test; do not use it to scan unrelated third-party sites.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill enables active scanning of a user-supplied WordPress URL but does not clearly warn that this will send probing traffic to the specified host. That omission can lead users to unknowingly target third-party systems without authorization, creating legal, policy, and abuse risks even if the feature is presented as legitimate security testing.

VirusTotal

65/65 vendors flagged this skill as clean.