T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:38- Finding
WordPress Basic Authentication Credentials May Be Sent Without Enforced TLS
- Content
View full analysis
- Remediation
View remediation
Security audit
WordPress Blog Publisher
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent WordPress publishing skill, but it needs review because it can publish or alter live site content while handling credentials, external media, and raw HTML without enough safety boundaries.
Install only if you are comfortable with an agent using a WordPress Application Password to publish or update real site content. Use a dedicated least-privilege WordPress account, require HTTPS, review the first item as a draft, avoid untrusted markdown, and do not let it fetch or mirror external images or raw embeds without explicit review.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/markdown-to-html-rules.md:78- Finding
Unvalidated External Image Downloads Create an SSRF and Resource-Exhaustion Primitive
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/markdown-to-html-rules.md:96- Finding
Unsanitized Raw HTML and Arbitrary Iframes May Be Published to WordPress
- Content
View full analysis
` embeds (YouTube, etc.) - Do not add ``, ``, or `` wrappers ``` ### Technical Analysis The Skill explicitly instructs the Agent to preserve HTML already present in Markdown and to retain iframe elements. It does not require sanitization, an HTML element and attribute allowlist, safe URL-scheme validation, or an allowlist of trusted iframe origins. If article content is untrusted, it can contain active markup, event-handler attributes, dangerous URLs, tracking elements, deceptive overlays, or iframes hosted by an attacker. WordPress may sanitize some markup depending on configuration and the authenticated user's capabilities, but relying on unspecified downstream filtering is unsafe. Privileged WordPress users may have permission to publish markup that lower-privileged users cannot. This behavior is not required for ordinary Markdown publishing. Supporting approved embeds can be implemented with a narrow host and attribute allowlist rather than passing all raw HTML through unchanged. ### Attack Path 1. An attacker supplies or modifies Markdown content in an upstream source such as a shared table, document, or content queue. 2. The content includes malicious raw HTML or an iframe referencing an attacker-controlled origin. 3. The Agent follows the conversion rules and preserves the markup without sanitization. 4. The Agent submits the resulting HTML using an authenticated WordPress account. 5. If the WordPress configuration accepts the markup, it becomes stored content. 6. Visitors or administrators opening the published page load the hostile embed or exe ...[truncated 977 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown reference includes a Basic Authorization header and application password format, which involves sensitive credentials. The document provides no warning about protecting app passwords, avoiding accidental logging/sharing, or using HTTPS when transmitting them, despite the category requiring warnings for behaviors affecting privacy or system integrity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The reference documents create, update, and delete endpoints for WordPress posts, including a DELETE operation, but does not include any warning that these actions modify live site content and may be irreversible or affect published data. For markdown files, omission of warnings about actions affecting user data or system integrity is in scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guidance instructs the agent to fetch third-party image URLs and re-upload them to WordPress without requiring user awareness or confirmation that external content will be retrieved, transferred, and republished. In a publishing skill, this can cause unintended network access, import untrusted or copyrighted material, and silently move third-party content into the user's own site infrastructure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The rules direct the system to generate images from prompts and publish them to WordPress without warning that prompts may be sent to an external image generation service and that the resulting media will be publicly posted. This creates data handling and publication risks, especially if prompts contain sensitive information or if users do not realize generated assets will be uploaded automatically.
- Content