wordpress-content
Pass
Audited by Gen Agent Trust Hub on Feb 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [Indirect Prompt Injection] (LOW): The skill processes external data from CSV and HTML files and downloads content from remote URLs, creating a potential surface for indirect prompt injection. Ingestion points:
posts.csvandpost-content.htmlare read for bulk creation and post updates;wp media importfetches data from external URLs. Boundary markers: Absent. Capability inventory: Full WordPress management viawpCLI (creating/updating posts, managing terms, importing media) andcurl. Sanitization: No explicit sanitization or validation of the input file content is demonstrated. - [External Downloads] (LOW): The skill provides instructions for importing media directly from remote URLs using
wp media import(references/wp-cli-content.md), which is a standard feature of WP-CLI. - [Command Execution] (LOW): The skill relies on system commands like
wp,curl,scp, andxargsto manage remote WordPress instances, which is the primary intended function (SKILL.md).
Audit Metadata