wordpress-penetration-testing
Warn
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions require the execution of various command-line tools such as wpscan, nmap, and curl to perform security scanning and data retrieval.
- [REMOTE_CODE_EXECUTION]: The skill provides functional code for creating webshells and reverse shells, facilitating the deployment of malicious code to remote targets.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. 1. Ingestion points: Data is fetched from untrusted remote URLs via curl and wpscan in multiple phases. 2. Boundary markers: No delimiters or ignore instructions are used to separate fetched content from the agent's instructions. 3. Capability inventory: The agent has access to shell execution (bash), local file creation (cat), and exploitation frameworks (msfconsole). 4. Sanitization: There is no validation or sanitization performed on the content retrieved from external targets before it is processed by the agent.
Audit Metadata