The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses wp-cli (wp gf) to manage WordPress plugins, including installation, updates, and database migrations.
[COMMAND_EXECUTION]: The scripts/gf-inspect.sh script facilitates remote auditing by executing commands over SSH on WP Engine production and staging environments.
[REMOTE_CODE_EXECUTION]: The skill employs wp eval to execute PHP code within the WordPress environment, which is used to check for the presence of security-related constants in wp-config.php.
[DATA_EXFILTRATION]: The skill includes procedures for exporting form entries (which may contain sensitive user data) to the local filesystem. The audit script also checks the database for the existence of API keys to ensure they are not stored in insecure locations.
[PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests form entries which could contain malicious instructions.
Ingestion points: Form entry data is retrieved using wp gf entry list and GFAPI functions in SKILL.md and scripts/gf-inspect.sh.
Boundary markers: Absent; there are no delimiters or specific instructions to the agent to disregard instructions embedded within the form data.
Capability inventory: The agent has the capability to execute shell commands (wp, ssh), write to the filesystem (file_put_contents), and perform network operations through the Gravity Forms CLI.
Sanitization: No sanitization or validation of the retrieved entry content is performed before it is processed by the agent.

wp-gravity-forms