wp-bootstrap

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt explicitly asks the agent to collect and place secrets (API keys, WPE_SSH_KEY, WPE API credentials) into commands/config files (e.g., composer http-basic <API_KEY>, setting GitHub/WPE secrets), which would require embedding secret values verbatim and thus is high-risk credential handling.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill’s runtime scripts (playground-start.sh and playground-verify.sh) call "pnpm dlx @wp-playground/cli@latest", which fetches and executes code from the npm registry (i.e. via https://registry.npmjs.org for the @wp-playground/cli package) at runtime, making remote code execution a required dependency.