Security audit

Wordpress Auto Publish Clean

Security checks for vulnerabilities and agentic risk

Overview

The skill is meant for WordPress publishing, but it ships live-looking WordPress credentials and test/diagnostic scripts that can authenticate to and modify a fixed public site.

Review before installing. Do not run the bundled test, JWT, or fixed-target publishing scripts unless you understand exactly which WordPress site they will contact. Any exposed WordPress application passwords or JWT credentials in this package should be treated as compromised and revoked. Use your own least-privilege WordPress account, environment variables or a secret store, normal TLS verification, and explicit confirmation before publish/update/delete operations.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: simple-publish-minimal.sh:19
Finding: Hard-Coded WordPress Credentials Enable Unauthorized Remote Content Modification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: debug-jwt-install.js:14
Finding: TLS Certificate Verification Is Disabled for Authenticated WordPress Requests
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: jwt-verify.sh:59
Finding: JWT Bearer Token Is Written to a Predictable Plaintext Temporary File
Content: View full analysis
/tmp/jwt-token.txt echo " Token saved to: /tmp/jwt-token.txt" ``` The script writes the bearer token to the fixed path `/tmp/jwt-token.txt` without secure file creation, explicit restrictive permissions, or cleanup. ### Technical Analysis Bearer tokens confer access to any party possessing them. The script persists the JWT in plaintext under a predictable name in a commonly shared temporary directory. The write uses ordinary shell redirection and does not: - Set a restrictive `umask`. - Create the file atomically with exclusive semantics. - Verify that the destination is a regular file owned by the current user. - Prevent symbolic-link or hard-link attacks. - Remove the token when execution completes. - Avoid printing a token prefix to logs. Depending on the host's existing umask and temporary-directory controls, another local process may read the resulting file. A malicious local user may also prepare the path as a symbolic link before execution, causing the token to be written to an unintended destination accessible to the attacker. `get-jwt-token.js` similarly serializes the full token and associated account data to `jwt-token.json` without explicit restrictive permissions. ### Attack Path 1. A local attacker monitors the predictable `/tmp/jwt-token.txt` path or creates a malicious link ...[truncated 941 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: image-manager.js:104
Finding: Unrestricted URL and Local-Path Image Sources Permit Internal Network Access and File Disclosure
Content: View full analysis
maxSizeKB) { throw new Error(`File too large (${fileSizeKB}KB > ${maxSizeKB}KB)`); } ``` ### Technical Analysis The `source` value is treated as trusted solely on the basis of its prefix or local exi ...[truncated 3126 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (318)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is a simple Markdown-to-WordPress publishing skill, but the reported behavior includes authentication probing, CRUD operations, user/profile access, endpoint enumeration, media handling, and diagnostics. This is dangerous because users may invoke the skill expecting limited publishing behavior while it can authenticate, inspect, modify, and delete live WordPress content and interact with sensitive admin/auth endpoints.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: simple-publish.js:21

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: app-password-test.js:46

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: batch-publish-fixed.js:39

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: batch-publish-test.js:36

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: category-tag-manager-demo.js:35

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: category-tag-manager.js:38

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: final-app-password-test.js:40

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: get-jwt-token.js:50

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: image-manager-demo.js:36

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: image-manager.js:39

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: image-upload-test.js:36

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: publish-english-article-fixed.js:34

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: publish-english-article.js:34

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test-app-password-fixed.js:31

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test-app-password.js:30

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test-fixed-publish.js:18

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test-jwt-full.js:41

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test-new-password.js:24

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test-with-app-password.js:45

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: wordpress-api.js:21

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: debug-jwt-install.js:15

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: diagnose-jwt-issue.js:16

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: diagnose-jwt-remote.js:17

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: find-jwt-endpoint.js:15

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: jwt-final-check.js:15

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: jwt-token-auth-test.js:17

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: test-jwt-with-password.js:18

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: ultimate-jwt-test.js:17

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: verify-jwt-installation.js:15