wordpress-penetration-testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt contains multiple commands and examples that embed API tokens and passwords directly (e.g., --api-token YOUR_API_TOKEN, http-auth admin:password, set PASSWORD jessica), which would require the LLM to handle or emit secret values verbatim in generated commands or code.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document explicitly instructs on unauthorized credential attacks (brute-force, XML-RPC multicall), user enumeration, creation and upload of malicious plugins/webshells, and adding reverse shells to theme files — clear, intentional guidance for remote code execution, backdoors, and system compromise.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required runtime workflow uses curl/nmap/wpscan against a user-supplied target.com and ingests the fetched HTTP responses (HTML/RSS/REST JSON) into the agent’s context, which can include outsider-authored free text from public web content at that URL.