wordpress-wp-cli
Fail
Audited by Snyk on Mar 9, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt includes examples that embed plaintext secrets (e.g., --dbpass=secret, --admin_password=secret) directly into commands, which would require the LLM to handle and emit secret values verbatim, creating an exfiltration risk.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's documentation explicitly includes commands that fetch and import external, user-provided URLs (e.g., "wp embed fetch " in references/content-taxonomies.md and "wp media import ... | URL(s)" in content-taxonomies.md), meaning the agent could fetch and interpret arbitrary public web/social content as part of its workflow.
Audit Metadata