The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/perf_inspect.mjs programmatically executes WP-CLI commands (e.g., wp core version, wp doctor, wp profile) using spawnSync to collect diagnostic information. These commands are executed with arguments derived from user-provided inputs such as --path and --url.
[METADATA_POISONING]: The skill body and description reference WordPress version 6.9 and a 'Performance Field Guide' blog post dated November 18, 2025. These references are inconsistent with current WordPress release timelines and established history, which could mislead the agent regarding the environment's actual capabilities or safety features.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources, including WP-CLI command output and WordPress REST API response headers/bodies. These ingestion points represent a surface for indirect prompt injection if the WordPress site being analyzed has been compromised with malicious content intended to influence the agent's logic.
[EXTERNAL_DOWNLOADS]: The documentation in references/wp-cli-doctor.md and references/wp-cli-profile.md suggests the installation of additional WP-CLI packages (wp-cli/doctor-command and wp-cli/profile-command) from public repositories if they are missing from the current environment.

wp-performance