The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The upgrade workflow defined in references/upgrade.md (Step 1 and Step 4) instructs the agent to clone an external repository from a variable <upstream-url> and then execute a JavaScript file (upgrade-check.js) located within that freshly cloned directory using node. This behavior allows for the execution of arbitrary code from a remote source, which can be exploited if the source URL is malicious or compromised.
[EXTERNAL_DOWNLOADS]: The skill initiates network operations to fetch project files and configurations. It uses git clone to pull upstream code during upgrades and retrieves official agent skills from WordPress's GitHub repository. While the WordPress repository is a well-known source, the target of the git clone operation is determined by the user or repository metadata and is not restricted to trusted domains.
[COMMAND_EXECUTION]: The skill relies on various shell-based operations to automate tasks. It executes local utility scripts (scripts/plugin-replace.php, scripts/upgrade-check.js) and project-specific tasks via npm run, composer run, and npx for building assets, running quality assurance tools, and managing dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted content from the plugin's codebase to influence its own operations.
Ingestion points: The agent reads and parses README.md, composer.json, package.json, and various PHP source files (src/*.php) to generate documentation and perform sync tasks.
Boundary markers: There are no explicit markers or instructions to ignore embedded commands within the files being processed.
Capability inventory: The skill has permissions to execute shell commands, perform network clones, and write to the filesystem.
Sanitization: There is no documented evidence of input validation or content sanitization for the data ingested from the project files.

wp-plugin-bp