wp-wpengine
Fail
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches an installation script from the official WP Engine GitHub repository at https://raw.githubusercontent.com/wpengine/wpe-labs-platform-skills/main/install.sh.
- [REMOTE_CODE_EXECUTION]: Executes the downloaded installation script by piping the output of curl directly into bash.
- [COMMAND_EXECUTION]: Performs various system and network operations, including SSH connectivity to remote servers, Git push operations to hosting remotes, and WP-CLI command execution.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources which could potentially contain malicious instructions.
- Ingestion points: Remote WP-CLI command outputs and GitHub Actions deployment logs are ingested into the agent's context.
- Boundary markers: No explicit delimiter-based boundary markers are defined for remote tool outputs.
- Capability inventory: The skill has capabilities for SSH remote execution, Git repository modification, and file system writes (configuring SSH keys and config files).
- Sanitization: The instructions recommend safety measures such as using --dry-run for destructive operations and --skip-plugins for remote WP-CLI commands.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/wpengine/wpe-labs-platform-skills/main/install.sh - DO NOT USE without thorough review
Audit Metadata