The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The installation scripts (install_wp_plugin.sh) and troubleshooting guides (troubleshooting.md) frequently utilize sudo to perform administrative file operations, such as copying plugin files into the WordPress directory and modifying ownership to the web server user. While typical for site administration, this behavior involves elevated permissions.
[DYNAMIC_EXECUTION]: The skill employs python3 scripts within shell wrappers to dynamically modify configuration files (JSON/TOML) and patch PHP code in the mcp-adapter plugin to resolve known bugs. Additionally, it uses the wp eval command to execute arbitrary PHP code within the WordPress environment for automation purposes.
[INDIRECT_PROMPT_INJECTION]: The skill interacts with untrusted data by reading WordPress posts, comments, and media descriptions. This content could contain malicious instructions designed to manipulate agent behavior.
Ingestion points: wp_get_posts, wp_get_comments, wp_list_media (Path B) in references/ai-engine-tools.md; discover-abilities (Path A/C).
Boundary markers: Documentation in SKILL.md includes a safety warning for agents to treat content as untrusted.
Capability inventory: Full administrative access including wp_update_post, wp_delete_user, and wp_update_option across all paths.
Sanitization: The skill advises manual caution but lacks automated sanitization of fetched content.
[EXTERNAL_DOWNLOADS]: The skill automates the download of WordPress plugins from official WordPress.org repositories and GitHub releases from the WordPress organization and community authors.
[COMMAND_EXECUTION]: The skill's primary functionality relies on executing a variety of shell commands (wp-cli, curl, openssl) to manage the remote WordPress instance and update local environment configurations.

wordpress-mcp