The Agent Skills Directory

EXTERNAL_DOWNLOADS (HIGH): The INSTALL.md file directs users to clone a repository from an untrusted GitHub account (CrazySwami/wordpress-dev-skills). This bypasses the safety of vetted skill sources.
REMOTE_CODE_EXECUTION (HIGH): The skill provides explicit instructions to grant execution permissions (chmod +x) to downloaded scripts and run them via python3 and node. This includes scripts like extract-brand.py, screenshot.py, and audit.py which are not part of the provided file set and must be fetched from the remote repository.
PROMPT_INJECTION (MEDIUM): The skill is vulnerable to indirect prompt injection (Category 8) by processing untrusted data from external URLs.
Ingestion points: Untrusted data enters via the --url and --base-url parameters in DISCOVERY.md and INSTALL.md when running extract-brand.py, screenshot.py, and audit.py.
Boundary markers: No boundary markers or 'ignore' instructions are present to prevent malicious content on the target websites from influencing the agent.
Capability inventory: The skill possesses significant capabilities including file system writes (--output flags), network requests (requests, playwright), and shell execution via slash commands.
Sanitization: No sanitization or validation of the external content is mentioned or implemented in the instructions.
COMMAND_EXECUTION (MEDIUM): The skill defines multiple slash commands (/wp-setup, /wp-audit, /wp-launch) that execute complex sequences of shell commands, including Docker operations and script triggers, expanding the agent's attack surface.

wp-orchestrator