The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on broad shell execution capabilities to drive WP-CLI and auxiliary utilities. It includes complex scripts using ssh, rsync, scp, jq, sed, and xargs to perform site-wide operations and data transformations across local and remote environments.
[DYNAMIC_EXECUTION]: The skill utilizes the wp eval command in multisite and user management workflows (e.g., in examples-multisite.md). This allows for the execution of arbitrary PHP code within the WordPress environment to bypass CLI limitations or access internal functions.
[INDIRECT_PROMPT_INJECTION]: The skill defines ingestion points for external data, specifically CSV files for bulk post and metadata imports (examples-content.md). The provided evidence shows a surface where untrusted input could be processed:
Ingestion points: import.csv and import-meta.csv in references/examples-content.md.
Boundary markers: The skill suggests user confirmation for destructive commands, but automated import loops lack robust per-item boundary enforcement.
Capability inventory: wp post create, wp post meta add, and wp eval across the reference scripts.
Sanitization: Employs weak sed patterns for quote stripping, which the documentation acknowledges as fragile, potentially allowing malformed data to influence command construction.
[CREDENTIALS_UNSAFE]: The skill necessitates interaction with wp-config.php, which contains sensitive database credentials and security keys. It also manages remote access via SSH aliases stored in ~/.wp-cli/config.yml.
[DATA_EXFILTRATION]: Migration workflows (examples-migration.md) utilize wp db export to create full database dumps, which are then transferred to external hosts using scp and rsync. While intended for legitimate migration, this pattern represents a capability for large-scale data exfiltration.
[PERSISTENCE]: The skill provides instructions for setting up system cron jobs (wp cron event run) to maintain WordPress background tasks. While a standard operational requirement, this establishes a persistent execution mechanism on the host system.

wp-cli