Security audit

Wordpress Article Publisher.Skill

Security checks for vulnerabilities and agentic risk

Overview

This WordPress publishing skill needs review because it can use site credentials to publish and delete or repost live content without clear safeguards.

Install only if you are comfortable giving the skill authority over a live WordPress site. Use a least-privilege WordPress application password, verify the target domain and post ID before any action, prefer draft or in-place update flows, and do not run deletion or delete-and-repost steps without a backup and explicit confirmation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The skill is described as a publisher, but it also documents a destructive modification flow that deletes an existing post and republishes it. This mismatch can cause unintended data loss, broken permalinks, loss of metadata/comments/SEO state, and user confusion because the destructive behavior is not clearly surfaced as a separate high-risk operation.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill is described as a WordPress article generation and publishing assistant, but this script adds a destructive post-deletion capability that is outside the stated purpose. Hidden or undocumented destructive functionality is dangerous because an agent or operator may invoke it unexpectedly, causing unauthorized content removal from the target WordPress site.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The file is explicitly labeled as an article deletion script, which contradicts the manifest's publisher-only framing and confirms the presence of undeclared destructive behavior. This mismatch increases the risk of operator deception, unsafe tool routing, or accidental invocation because reviewers may rely on the manifest to understand what the skill can do.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The trigger phrases are broad and loosely bounded, increasing the chance the skill activates when the user did not intend to perform a remote publishing action. In a skill that can take credentials and write to an external CMS, accidental invocation is more dangerous than in a read-only skill because it can lead to credential solicitation or unintended content changes.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill requests WordPress credentials and a publish endpoint, but it does not clearly warn that the information will be used for authenticated remote write operations against a live site. Without explicit risk disclosure and consent boundaries, users may provide sensitive secrets without understanding the consequences of transmission and publishing actions.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The modification workflow states that the script will delete the original article and repost it, but it does not provide strong warnings about the destructive nature of this action. In the WordPress context, deletion can permanently remove content or disrupt URLs, revisions, comments, taxonomy links, and integrations, making this materially riskier than ordinary publishing.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation instructs use of HTTP Basic authentication with application passwords and shows the Authorization header format without any guidance on secret handling. In a skill designed to publish to WordPress, this increases the chance that an agent or user will mishandle credentials, log them, paste them into insecure places, or reuse them unsafely.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script sends a DELETE request directly to the WordPress posts API using provided credentials and a PostId, with no confirmation prompt, dry-run mode, recycle/restore option, or validation that the user intended this exact destructive action. In an agent context, this makes accidental or prompt-induced irreversible deletion much more likely, especially since the skill already handles privileged credentials.

Static analysis

No suspicious patterns detected.