wordpress-admin

SUSPICIOUS. The skill’s main capabilities fit WordPress administration, but it embeds real production credentials, disables TLS certificate verification for FTP uploads, and grants broad shell-based production modification workflows. Data flows are mostly purpose-aligned and first-party/official, so this is not confirmed malware, but the credential handling and insecure remote transfer make it high security risk.

High security risk. The automation relies on executing shell command strings via subprocess.run(..., shell=True) constructed from parameterized inputs, creating a plausible command-injection pathway into docker exec/WP-CLI with direct WordPress integrity impact. Additionally, the documentation includes critical credential disclosure indicators (including an embedded literal lftp password) and instructs insecure secret storage under /root, and it provides production/destructive workflows with insufficient guardrails.

No clear indicators of embedded malware (no persistence, credential theft, or network exfiltration) are present in the shown code. The dominant security concern is host-side command execution risk: `subprocess.run(..., shell=True)` with command strings built from untrusted CLI inputs, with only partial escaping for one argument and no strict validation of `post_id`. This creates a plausible command-injection/sabotage vector that could lead to arbitrary command execution semantics via the docker/wp-cli workflow or unintended wp-cli actions. The fragment also appears truncated, so confidence is limited.

This module is primarily a WordPress administration wrapper around docker exec wp-cli, with no clear indicators of embedded malware (no exfiltration/persistence/obfuscated payloads). The dominant security concern is a high-impact implementation weakness: it uses subprocess.run(..., shell=True) with shell-interpolated command strings built from user-controlled inputs with incomplete escaping. This can enable command injection and abuse of WordPress modification operations, making the overall security posture meaningfully risky in environments where untrusted inputs can reach this CLI.