Security audit

WP Multitool — WordPress Optimization Toolkit

Security checks for vulnerabilities and agentic risk

Overview

Review is needed because a cleanup recipe can delete more revision history than promised, and a diagnostic query exceeds its stated data limits.

Start with read-only diagnostics and omit profiler URLs from output. Avoid the manual revision-cleanup fallback until it actually preserves five revisions. Before approving changes, verify a restorable backup and review exactly what will be deleted or modified; approve plugin activation and diagnostic-log deletion explicitly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

The fallback for 'Keep Last 5' deletes every post revision instead.

High

Category: Excessive Agency
Confidence: 100% confidence
Finding: The fallback enumerates every revision and permanently deletes them with --force, rather than retaining five revisions per post as the heading promises. User confirmation based on that description could therefore authorize substantially more deletion than intended, eliminating revision-based recovery; the backup recommendation mitigates this only if followed.
Content: No source excerpt is available for this finding.

The callback profiler query returns raw URLs despite the stated aggregate-only SQL safeguard.

Medium

Category: Excessive Agency
Confidence: 98% confidence
Finding: The profiler query selects raw URLs despite the stated metadata-only and no-sensitive-data safeguards. Depending on the profiled requests, URLs can contain reset tokens, authentication parameters, personal identifiers, or private paths, exposing them to the agent and its output; no external exfiltration destination is shown.
Content: No source excerpt is available for this finding.

Slow-query log deletion is exposed without a corresponding declared write permission.

Medium

Category: Excessive Agency
Confidence: 98% confidence
Finding: The command reference exposes a purge operation that deletes slow-query log entries. L004 enumerates permitted write operations but does not include deletion of monitoring logs; deleting these records is distinct from the declared transient, revision, and orphaned-metadata cleanup operations.
Content: No source excerpt is available for this finding.

Troubleshooting activates a plugin outside the declared write-operation permissions.

Medium

Category: Excessive Agency
Confidence: 99% confidence
Finding: Troubleshooting directs the agent to activate a plugin even though plugin activation is outside the enumerated write-operation scope. Activation changes site behavior and can execute activation hooks with database or filesystem side effects; the global requirement to confirm all writes reduces the risk but does not explicitly expand the declared permission scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.