ClawHub
Back to skill

Security audit

MakeWPFast Benchmark

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly purpose-aligned, but site audits can disclose more of a WordPress site's active-plugin inventory and use more paid quota than the `--top` wording suggests, and wp-cli is silently allowed to run as root when the agent is already root.

Review before installing if you may audit sensitive WordPress sites. Use lookup/compare freely for named plugins, but treat audit as sharing active-plugin inventory metadata with MakeWPFast and potentially spending quota for every uncached active plugin, not just the displayed `--top` results. Avoid running audits as root unless you explicitly accept wp-cli root execution.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/mwf-bench:599
Finding

The audit command transmits all active plugin slugs despite the --top limit

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (19)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mwf-bench (reported line 19)May include surrounding context.

text
me                                   Your tier / quota / usage (free, no quota charge)
  resolve <name> [--theme]             Show the resolved slug (no paid call)
  audit [--path .] [--top N]           Benchmark the heavy active plugins of a local WP site
  auth                                 Store your API key (keychain or 0600 file)

Key resolution order: $MWF_API_KEY  ->  macOS keychain  ->  ~/.config/makewpfast/key
Get a key at https://makewpfast.com/api/

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mwf-bench (reported line 21)May include surrounding context.

text
me                                   Your tier / quota / usage (free, no quota charge)
  resolve <name> [--theme]             Show the resolved slug (no paid call)
  audit [--path .] [--top N]           Benchmark the heavy active plugins of a local WP site
  auth                                 Store your API key (keychain or 0600 file)

Key resolution order: $MWF_API_KEY  ->  macOS keychain  ->  ~/.config/makewpfast/key
Get a key at https://makewpfast.com/api/

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mwf-bench (reported line 82)May include surrounding context.

text
me                                   Your tier / quota / usage (free, no quota charge)
  resolve <name> [--theme]             Show the resolved slug (no paid call)
  audit [--path .] [--top N]           Benchmark the heavy active plugins of a local WP site
  auth                                 Store your API key (keychain or 0600 file)

Key resolution order: $MWF_API_KEY  ->  macOS keychain  ->  ~/.config/makewpfast/key
Get a key at https://makewpfast.com/api/

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mwf-bench (reported line 126)May include surrounding context.

text
me                                   Your tier / quota / usage (free, no quota charge)
  resolve <name> [--theme]             Show the resolved slug (no paid call)
  audit [--path .] [--top N]           Benchmark the heavy active plugins of a local WP site
  auth                                 Store your API key (keychain or 0600 file)

Key resolution order: $MWF_API_KEY  ->  macOS keychain  ->  ~/.config/makewpfast/key
Get a key at https://makewpfast.com/api/

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mwf-bench (reported line 671)May include surrounding context.

text
me                                   Your tier / quota / usage (free, no quota charge)
  resolve <name> [--theme]             Show the resolved slug (no paid call)
  audit [--path .] [--top N]           Benchmark the heavy active plugins of a local WP site
  auth                                 Store your API key (keychain or 0600 file)

Key resolution order: $MWF_API_KEY  ->  macOS keychain  ->  ~/.config/makewpfast/key
Get a key at https://makewpfast.com/api/

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mwf-bench (reported line 44)May include surrounding context.

text
SUBSCRIBE_URL = "https://makewpfast.com/api/"
USER_AGENT = "mwf-bench/1.0 (+https://makewpfast.com/api/)"

KEYCHAIN_SERVICE = "makewpfast-bench"
KEYCHAIN_ACCOUNT = "default"
CONFIG_DIR = Path.home() / ".config" / "makewpfast"
KEY_FILE = CONFIG_DIR / "key"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mwf-bench (reported line 45)May include surrounding context.

text
SUBSCRIBE_URL = "https://makewpfast.com/api/"
USER_AGENT = "mwf-bench/1.0 (+https://makewpfast.com/api/)"

KEYCHAIN_SERVICE = "makewpfast-bench"
KEYCHAIN_ACCOUNT = "default"
CONFIG_DIR = Path.home() / ".config" / "makewpfast"
KEY_FILE = CONFIG_DIR / "key"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mwf-bench (reported line 89)May include surrounding context.

text
SUBSCRIBE_URL = "https://makewpfast.com/api/"
USER_AGENT = "mwf-bench/1.0 (+https://makewpfast.com/api/)"

KEYCHAIN_SERVICE = "makewpfast-bench"
KEYCHAIN_ACCOUNT = "default"
CONFIG_DIR = Path.home() / ".config" / "makewpfast"
KEY_FILE = CONFIG_DIR / "key"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mwf-bench (reported line 90)May include surrounding context.

text
SUBSCRIBE_URL = "https://makewpfast.com/api/"
USER_AGENT = "mwf-bench/1.0 (+https://makewpfast.com/api/)"

KEYCHAIN_SERVICE = "makewpfast-bench"
KEYCHAIN_ACCOUNT = "default"
CONFIG_DIR = Path.home() / ".config" / "makewpfast"
KEY_FILE = CONFIG_DIR / "key"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mwf-bench (reported line 122)May include surrounding context.

text
SUBSCRIBE_URL = "https://makewpfast.com/api/"
USER_AGENT = "mwf-bench/1.0 (+https://makewpfast.com/api/)"

KEYCHAIN_SERVICE = "makewpfast-bench"
KEYCHAIN_ACCOUNT = "default"
CONFIG_DIR = Path.home() / ".config" / "makewpfast"
KEY_FILE = CONFIG_DIR / "key"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mwf-bench (reported line 123)May include surrounding context.

text
SUBSCRIBE_URL = "https://makewpfast.com/api/"
USER_AGENT = "mwf-bench/1.0 (+https://makewpfast.com/api/)"

KEYCHAIN_SERVICE = "makewpfast-bench"
KEYCHAIN_ACCOUNT = "default"
CONFIG_DIR = Path.home() / ".config" / "makewpfast"
KEY_FILE = CONFIG_DIR / "key"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
82% confidence
Finding

The tool automatically adds --allow-root when executed as UID 0, causing wp-cli to run in a mode it intentionally blocks by default. In agent or CI environments where this script may run with elevated privileges, this removes a safety barrier and can make any wp-cli plugin-loading side effects or path mis-targeting execute as root against the local system or site files.

Content

Scanner excerpt · scripts/mwf-bench (reported line 561)May include surrounding context.

text
def detect_active_plugins(path):
    """Use wp-cli to list active plugin slugs. Returns (slugs, error)."""
    # wp-cli refuses to run as root without --allow-root (common in Docker/CI/managed hosts).
    root_flag = ["--allow-root"] if hasattr(os, "geteuid") and os.geteuid() == 0 else []
    wp = None
    for cand in ("wp", "wp-cli", "wp-cli.phar"):

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
82% confidence
Finding

The auto-construction of root_flag means root execution proceeds silently rather than requiring explicit human confirmation. In the context of an agent skill that may audit arbitrary local paths, this increases the blast radius of mistakes or malicious prompting because wp-cli commands can execute with full filesystem privileges.

Content

Scanner excerpt · scripts/mwf-bench (reported line 562)May include surrounding context.

text
def detect_active_plugins(path):
    """Use wp-cli to list active plugin slugs. Returns (slugs, error)."""
    # wp-cli refuses to run as root without --allow-root (common in Docker/CI/managed hosts).
    root_flag = ["--allow-root"] if hasattr(os, "geteuid") and os.geteuid() == 0 else []
    wp = None
    for cand in ("wp", "wp-cli", "wp-cli.phar"):
        try:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
a clean WordPress baseline.

The API is **paid and quota-limited**. The CLI protects the user's quota with a local cache,
name→slug resolution, and batch guards — so **always delegate to the CLI; never hand-write
`curl`**. Treat the CLI as the only way to touch the API.

## Setup (once)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/examples.md (reported line 46)May include surrounding context.

md
1. `mwf-bench lookup <plugin>` to get its grade.
2. Propose 1–3 well-known alternatives from your own knowledge.
3. `mwf-bench compare <plugin> <alt1> <alt2>` to verify they're actually faster — don't claim an
   alternative is faster without checking it against the dataset.

## Quota discipline reminders
- Cached rows print "(cached, N days old)" and don't touch the API.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mwf-bench (reported line 39)May include surrounding context.

text
from pathlib import Path

API_BASE = "https://makewpfast.com/wp-json/mwf-api/v1"
WPORG_PLUGINS = "https://api.wordpress.org/plugins/info/1.2/"
WPORG_THEMES = "https://api.wordpress.org/themes/info/1.2/"
SUBSCRIBE_URL = "https://makewpfast.com/api/"
USER_AGENT = "mwf-bench/1.0 (+https://makewpfast.com/api/)"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mwf-bench (reported line 40)May include surrounding context.

text
from pathlib import Path

API_BASE = "https://makewpfast.com/wp-json/mwf-api/v1"
WPORG_PLUGINS = "https://api.wordpress.org/plugins/info/1.2/"
WPORG_THEMES = "https://api.wordpress.org/themes/info/1.2/"
SUBSCRIBE_URL = "https://makewpfast.com/api/"
USER_AGENT = "mwf-bench/1.0 (+https://makewpfast.com/api/)"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/mwf-bench (reported line 561)May include surrounding context.

text
def detect_active_plugins(path):
    """Use wp-cli to list active plugin slugs. Returns (slugs, error)."""
    # wp-cli refuses to run as root without --allow-root (common in Docker/CI/managed hosts).
    root_flag = ["--allow-root"] if hasattr(os, "geteuid") and os.geteuid() == 0 else []
    wp = None
    for cand in ("wp", "wp-cli", "wp-cli.phar"):

Static analysis

No suspicious patterns detected.