fluent-wp-client-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit examples and flags that pass passwords, JWT tokens, and Authorization headers directly on the command line (e.g., --password, --token, --auth-header), which requires the agent to emit secret values verbatim in generated commands and is therefore insecure.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The CLI explicitly fetches and discovers REST API schemas from arbitrary WordPress sites (via the npx fluent-wp-client schemas --url <url> command and the documented interactive mode in SKILL.md), ingesting untrusted public/user-generated content that is used to generate Zod/TypeScript validators and can therefore materially influence downstream behavior.