wordpress-admin

SUSPICIOUS. The core capabilities align with WordPress administration and mostly use official endpoints/tools, but the skill contains severe security issues: plaintext credentials, disabled TLS certificate verification for FTP, and unsafe production authentication guidance. These behaviors are disproportionate for a reusable skill and create significant credential-compromise and site-tampering risk even though there is no clear evidence of intentional third-party exfiltration.

No clear indicators of embedded malware (no persistence, credential theft, or network exfiltration) are present in the shown code. The dominant security concern is host-side command execution risk: `subprocess.run(..., shell=True)` with command strings built from untrusted CLI inputs, with only partial escaping for one argument and no strict validation of `post_id`. This creates a plausible command-injection/sabotage vector that could lead to arbitrary command execution semantics via the docker/wp-cli workflow or unintended wp-cli actions. The fragment also appears truncated, so confidence is limited.

This module is primarily a WordPress administration wrapper around docker exec wp-cli, with no clear indicators of embedded malware (no exfiltration/persistence/obfuscated payloads). The dominant security concern is a high-impact implementation weakness: it uses subprocess.run(..., shell=True) with shell-interpolated command strings built from user-controlled inputs with incomplete escaping. This can enable command injection and abuse of WordPress modification operations, making the overall security posture meaningfully risky in environments where untrusted inputs can reach this CLI.