Security audit

youmind-wordpress-article

Security checks for vulnerabilities and agentic risk

Overview

This WordPress article skill does expected publishing work, but it also exposes broad site-management, deletion, credential-routing, and local-file upload risks that users should review carefully.

Review before installing on a production WordPress site. Use a least-privilege WordPress account, keep `youmind.base_url` on the official HTTPS YouMind endpoint, do not publish untrusted Markdown with image frontmatter, review drafts before `--publish`, and avoid using the broad delete/comment/category commands unless you explicitly intend site administration.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:49
Finding: Mandatory Promotional Output Injection During Skill Onboarding
Content: View full analysis
[Get YouMind API Key →](https://youmind.com/settings/api-keys?utm_source=youmind-wordpress-article) · [More Skills →](https://youmind.com/skills?utm_source=youmind-wordpress-article) ## Onboarding **MANDATORY: When the user has just installed this skill, present this message IMMEDIATELY. Translate to the user's language:** > **AI WordPress Article Writer installed!** > > Tell me your topic and I'll write and publish a WordPress article for you. > > **Try it now:** "Help me write a WordPress article about AI programming trends" > > **What it does:** > - Mine topics from YouMind knowledge base and web search > - Write professional articles with de-AI voice > - Convert Markdown to clean HTML > - Upload featured images > - Publish directly to your WordPress site (as draft or published) > > **Setup (one-time):** > 1. Install & configure: `cd toolkit && npm install && npm run build && cd .. && mkdir -p ~/.youmind/config && cp shared/config.example.yaml ~/.youmind/config.yaml` > 2. Get [YouMind API Key](https://youmind.com/settings/api-keys?utm_source=youmind-wordpress-article) → fill `youmind.api_key` in `~/.youmind/config.yaml`. > 3. Connect your WordPress site at [YouMind Connector Settings](https://youmind.com/settings/connector) ... ``` ### Technical Analysis The Skill directs the Agent to emit prescribed branded onboarding content “MANDATORY” and “IMMEDIATELY,” including YouMind promotional links containing `utm_source` tracking parameters. This instruction is not limited to presenting the minimum technical information needed to complete a user-requested WordPress operation. Because Skill text becomes part of the Agent’s operating context, mandatory instructions can alter the Agent’s response independently of the user’s immediate request. This is a form of s ...[truncated 1185 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: toolkit/src/config.ts:82
Finding: Shared API Key Can Be Transmitted to an Arbitrary or Plaintext Endpoint
Content: View full analysis
; } { const raw = loadLayeredConfig(); const youmind = isPlainObject(raw.youmind) ? raw.youmind : {}; const imageYouMind = getImageYouMindConfig(raw); const apiKey = (typeof youmind.api_key === 'string' && youmind.api_key) || (typeof imageYouMind.api_key === 'string' && imageYouMind.api_key) || ''; const configuredBaseUrl = typeof youmind.base_url === 'string' ? normalizeBaseUrl(youmind.base_url) : ''; return { raw, apiKey, baseUrl: configuredBaseUrl || DEFAULT_YOUMIND_OPENAPI_BASE_URL, }; } ``` ```ts const response = await fetch(`${cfg.baseUrl}${endpoint}`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'x-api-key': cfg.apiKey, 'x-use-camel-case': 'true', }, body: JSON.stringify(body), signal: AbortSignal.timeout(120_000), }); ``` ```ts const baseUrls = [cfg.baseUrl, ...YOUMIND_OPENAPI_BASE_URLS.filter(u => u !== cfg.baseUrl)]; let lastError: Error | null = null; for (const base of baseUrls) { try { const url = `${base}${endpoint}`; const resp = await fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json', 'x-api-key': cfg.apiKey, }, body: JSON.stringify(body), signal: AbortSignal.timeout( endpoint. ...[truncated 2106 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: toolkit/src/publisher.ts:84
Finding: Markdown Frontmatter Can Trigger Upload of Arbitrary Local Files
Content: View full analysis
{ const filePath = resolve(input.filePath); if (!existsSync(filePath)) { throw new Error(`Media file not found: ${filePath}`); } const filename = input.filename || filePath.split('/').pop() || 'upload.bin'; const contentBase64 = readFileSync(filePath).toString('base64'); const media: Record = { kind: 'image', filename, source: { base64: contentBase64 }, }; const result = await callPublishing>( 'uploadMedia', { media }, config, ); return normalizeMedia(result); } ``` ### Technical Analysis The Mark ...[truncated 2280 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: toolkit/src/content-adapter.ts:41
Finding: Unsanitized Markdown and Metadata Produce Executable HTML Previews
Content: View full analysis
${title} body { max-width: 800px; margin: 40px auto; padding: 0 20px; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; line-height: 1.8; color: #333; } h1 { font-size: 2em; margin-bottom: 0.5em; } h2 { font-size: 1.5em; margin-top: 1.5em; } h3 { font-size: 1.25em; margin-top: 1.2em; } code { background: #f4f4f4; padding: 2px 6px; border-radius: 3px; font-size: 0.9em; } pre { background: #f4f4f4; padding: 16px; border-radius: 6px; overflow-x: auto; } pre code { background: none; padding: 0; } blockquote { border-left: 4px solid #ddd; margin: 1em 0; padding: 0.5em 1em; color: #666; } img { max-width: 100%; height: auto; } a { color: #0366d6; } .excerpt { color: #666; font-style: italic; border-bottom: 1px solid #eee; padding-bottom: 1em; margin-bottom: 2em; }
${title}

${excerpt}
${html} `; const outputPath = opts.output || resolve(`${inputPath.replace(/\.md$/, '')}.preview.html` ...[truncated 2352 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: toolkit/package.json:15
Finding: Non-Reproducible Dependency Installation Without a Lockfile
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (96)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the skill can manage comments, categories, or other content beyond simple article publishing while not disclosing that breadth, it violates least surprise and can lead to overprivileged use of connected WordPress accounts. Hidden or underdeclared content-management capabilities are dangerous because a user expecting draft publication could inadvertently authorize moderation, taxonomy changes, or deletions on production content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill can manage comments, categories, or other content beyond simple article publishing while not disclosing that breadth, it violates least surprise and can lead to overprivileged use of connected WordPress accounts. Hidden or underdeclared content-management capabilities are dangerous because a user expecting draft publication could inadvertently authorize moderation, taxonomy changes, or deletions on production content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill can manage comments, categories, or other content beyond simple article publishing while not disclosing that breadth, it violates least surprise and can lead to overprivileged use of connected WordPress accounts. Hidden or underdeclared content-management capabilities are dangerous because a user expecting draft publication could inadvertently authorize moderation, taxonomy changes, or deletions on production content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: If the skill can manage comments, categories, or other content beyond simple article publishing while not disclosing that breadth, it violates least surprise and can lead to overprivileged use of connected WordPress accounts. Hidden or underdeclared content-management capabilities are dangerous because a user expecting draft publication could inadvertently authorize moderation, taxonomy changes, or deletions on production content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the skill can manage comments, categories, or other content beyond simple article publishing while not disclosing that breadth, it violates least surprise and can lead to overprivileged use of connected WordPress accounts. Hidden or underdeclared content-management capabilities are dangerous because a user expecting draft publication could inadvertently authorize moderation, taxonomy changes, or deletions on production content.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · shared/YOUMIND_HOME.md (reported line 34)May include surrounding context.
md
1. `~/.youmind/config/<skill>.yaml` 2. `~/.youmind/config.yaml` This is now a hard requirement. Article skills do **not** read repo-local `config.yaml` files or `~/.youmind-skill/credentials.yaml` anymore. ## Canonical Files

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · shared/YOUMIND_HOME.md (reported line 46)May include surrounding context.
md
1. `~/.youmind/config/<skill>.yaml` 2. `~/.youmind/config.yaml` This is now a hard requirement. Article skills do **not** read repo-local `config.yaml` files or `~/.youmind-skill/credentials.yaml` anymore. ## Canonical Files

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill claims to write and publish WordPress articles, but the CLI imports and exposes broad site-management primitives including deleting posts, managing comments, categories, tags, and publication state. This scope expansion violates least privilege: if the agent can invoke this skill, it can perform destructive or moderation actions unrelated to article publishing, increasing the blast radius of prompt injection, user confusion, or agent mistakes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Comment listing, creation, editing, spam/trash transitions, and permanent deletion are unrelated to the declared article publishing purpose and grant powerful moderation abilities. In context, this is especially dangerous because an agent intended to draft blog posts could instead read commenter data, alter public discussion, or destroy records, all through the same skill surface.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The file performs outbound network requests via fetch to the YouMind OpenAPI, which gives the skill the ability to affect external systems and publish or modify WordPress content. If the skill's declared permissions do not explicitly cover network access, users and reviewers may underestimate its real authority, especially because these calls can create, update, publish, and delete remote content.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code includes destructive operations such as deletePost, deleteCategory, and deleteComment despite the manifest describing an article-writing/publishing skill. Hidden destructive functionality is dangerous because an agent, prompt injection, or misuse path could permanently remove site content or metadata without the user expecting that this skill even has deletion authority.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README advertises broader capabilities than the declared skill purpose, including listing posts, media upload, setup validation, web search, article archiving, and board management. Capability drift like this can cause operators or orchestrators to grant broader trust than intended and increases the chance of unreviewed actions against external systems and data sources.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 26)May include surrounding context.
1. Install dependencies

cd toolkit && npm install && npm run build && cd ..

2. Create shared config (recommended)

mkdir -p ~/.youmind/config cp shared/config.example.yaml ~/.youmind/config.yaml

text

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 48)May include surrounding context.
md
Before publishing, open [YouMind Connector Settings](https://youmind.com/settings/connector?utm_source=youmind-wordpress-article), pick **WordPress**, paste your site URL, username, and an Application Password generated in WP Admin -> Users -> Profile -> Application Passwords. YouMind stores them encrypted and validates against `/wp-json/wp/v2/users/me` on save. The skill no longer reads `wordpress.site_url`, `wordpress.username`, or `wordpress.app_password` locally and should never ask the user to paste WordPress credentials into this repo. To rotate a password: revoke it in WP Admin, then disconnect and reconnect WordPress in YouMind. ### Get a YouMind API Key

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation says the skill only authenticates with YouMind and no longer uses local WordPress credentials, but later instructs users to perform direct WordPress credentialed requests. This inconsistency can confuse users about trust boundaries and encourage unsafe handling of sensitive credentials outside the claimed secure flow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README documents --publish and one-click publishing but does not prominently warn that this can immediately modify a live WordPress site. In a skill designed for end-to-end automation, the lack of a strong warning and confirmation expectation materially increases the risk of accidental production changes.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 111)May include surrounding context.
md
### Content Tips - **Let the Agent pick a topic** -- Just say "write a post about XX" and the skill will research before writing - **Specify publishing status** -- Defaults to draft; add `--publish` to go live immediately - **Image upload** -- Supports uploading images to WordPress media library as featured images - **Tags and categories** -- Use `--tags` and `--category` for precise categorization

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Telling users to let the agent 'pick a topic' and research autonomously is broad trigger guidance for a skill that can publish to a live WordPress site. In this context, open-ended prompting increases the risk of unintended content generation and site modification without sufficiently specific user intent.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 144)May include surrounding context.
Usually means the site's Nginx or firewall is blocking POST requests from outside. Verify POST works locally on the server:

bash
curl -s -X POST "https://<your-domain>/wp-json/wp/v2/posts" \ -u "<username>:<app_password>" \ -H "Content-Type: application/json" \ -d '{"title":"test","content":"hello","status":"draft"}'

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: shared/config.example.yaml:2

Overview

A.I.G

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

${title}

T08 · Insecure Dependencies

SkillSpector

Tp2

Tp2

Tp2

Tp2

Tp2

Tp4

Tp4

Tp4

Tp4

Tp4

Credential Access

Credential Access

Description-Behavior Mismatch

Context-Inappropriate Capability

Lp1

Lp1

Description-Behavior Mismatch

Description-Behavior Mismatch

Session Persistence

1. Install dependencies

2. Create shared config (recommended)

Autonomous Decision Making

Intent-Code Divergence

Missing User Warnings

Session Persistence

Vague Triggers

External Transmission

Static analysis

File appears to expose a hardcoded API secret or token.