The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses curl to perform health checks on managed domains (e.g., curl -s -o /dev/null -w "%{http_code}\n" https://DOMAIN/). This is a benign use of command execution to verify that a site is still responsive after updates.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, presenting a theoretical vulnerability surface.
Ingestion points: Data enters the agent context via API calls like wordpress_installations_list and wordpress_plugins_list-installed, which retrieve site metadata, plugin names, and version strings.
Boundary markers: The instructions do not explicitly require the agent to use delimiters or ignore instructions embedded in the API data.
Capability inventory: The agent has the ability to execute shell commands (curl) and perform site modifications (update, deactivate, or uninstall plugins/themes) through the Hostinger API.
Sanitization: No explicit sanitization or validation of the API-returned strings is defined in the skill instructions.
[SAFE]: The skill is authored by the platform vendor (Hostinger) and interacts exclusively with the vendor's own API tools (wordpress_*, hosting_*, agency-hosting_*).
[SAFE]: The skill includes explicit security precautions, such as instructing the agent to never store or reuse temporary wp-admin login links and to ask for user approval before applying changes.

maintain-wordpress