WordPress Blog Automation

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:39 AM UTC
• Version: 1.0.1

Overview

This skill is a plausible WordPress publishing helper, but it handles publishing credentials and public post creation without enough destination or failure-handling safeguards.

Install only if you control the WordPress destination and can constrain usage to an HTTPS site you trust. Use a dedicated low-privilege WordPress application password, avoid passing secrets through shared command histories or logs, and keep backups of article JSON files because the failure fallback can overwrite an input file in some cases.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: index.py:27

Finding

WordPress credentials may be transmitted to an untrusted or unencrypted endpoint

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.py:87

Finding

Failure handling may overwrite the source article file

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises capabilities that involve reading files, writing logs, and making network calls to an external WordPress API, but it does not declare any explicit tool scope or permissions boundary. This creates an authorization and transparency gap: an agent or operator may invoke the skill without a clear, least-privilege declaration of what resources it can access or exfiltrate to the network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly relies on WordPress application credentials and publishes content to an external site, but it provides no warning about handling secrets or transmitting article data and media to a third-party endpoint. In practice, this can lead to accidental credential exposure, unsafe storage of application passwords, or unreviewed exfiltration of unpublished content and metadata to the configured WordPress instance.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · index.py (reported line 70)May include surrounding context.

python

}

        try:
            response = requests.post(
                f"{self.base_url}/posts",
                headers=headers,
                json=post_data,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code sends article title, content, author, categories, and tags to an external WordPress endpoint using an authenticated HTTP request. Aside from an internal docstring, there is no confirmation prompt or user-facing notice at the point of transmission, so data leaves the local system without explicit disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

On publish failure, the skill writes the rendered article content to a local HTML file automatically, which can leave sensitive or embargoed content on disk without the user's awareness. If the article contains confidential material or the output path is in a shared workspace, this fallback can create unintended local data exposure and persistence.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.