wordpress-admin

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill prompt explicitly embeds an FTP password in plain text within an example lftp command block, creating an insecure credential handling risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill utilizes external third-party REST APIs (Pexels and Unsplash) for stock photo integration at runtime, but lacks clear publisher provenance and authenticated integrity controls for these services, making them weak/unknown operational dependencies.