wp-wpengine

Fail

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches an installation script from the official WP Engine GitHub repository at https://raw.githubusercontent.com/wpengine/wpe-labs-platform-skills/main/install.sh.
  • [REMOTE_CODE_EXECUTION]: Executes the downloaded installation script by piping the output of curl directly into bash.
  • [COMMAND_EXECUTION]: Performs various system and network operations, including SSH connectivity to remote servers, Git push operations to hosting remotes, and WP-CLI command execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources which could potentially contain malicious instructions.
  • Ingestion points: Remote WP-CLI command outputs and GitHub Actions deployment logs are ingested into the agent's context.
  • Boundary markers: No explicit delimiter-based boundary markers are defined for remote tool outputs.
  • Capability inventory: The skill has capabilities for SSH remote execution, Git repository modification, and file system writes (configuring SSH keys and config files).
  • Sanitization: The instructions recommend safety measures such as using --dry-run for destructive operations and --skip-plugins for remote WP-CLI commands.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/wpengine/wpe-labs-platform-skills/main/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 27, 2026, 07:32 AM