The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted files from a repository to generate structured reports and command recommendations. A malicious repository could contain crafted files (e.g., package.json, composer.json, or PHP headers) designed to mislead the agent or trick it into executing malicious scripts defined in those files.
Ingestion points: scripts/detect_wp_project.mjs reads various files including package.json, composer.json, wp-config.php, and PHP plugin/theme files from the project root and subdirectories.
Boundary markers: Absent. The script reads file contents directly into memory for regex matching without markers to distinguish data from instructions.
Capability inventory: The skill identifies and recommends shell commands (e.g., npm run lint, composer install) which the agent, having bash and node capabilities, is expected to execute.
Sanitization: Absent. The script extracts metadata and script names directly from repository files and includes them in the output JSON report.
[DATA_EXFILTRATION]: The script intentionally reads wp-config.php in scripts/detect_wp_project.mjs. While the current implementation only extracts specific configuration constants (like WP_DEBUG), the script reads the first 256KB of the file into memory. If the agent's environment captures this output or if the script were modified to include more fields, it could expose sensitive database credentials stored in that file.

wp-project-triage