wp-wpengine

SUSPICIOUS: the core WP Engine SSH/API/deploy workflows are coherent and mostly route to official vendor infrastructure, but the skill has meaningful security risk from secret handling, DB credential retrieval, and especially the unpinned same-org `curl|bash` installer that installs additional skills. This looks like a legitimate admin skill with medium supply-chain and credential-exposure risk rather than confirmed malware.

This is a deployment preflight script that queries a WP Engine installation and checks its HTTP endpoints. It contains no evident malware, but unvalidated INSTALL and remote SITE_URL values are embedded in shell command strings, creating command-injection risk if either is attacker-controlled; the URL also determines curl destinations. Severity is moderate and depends on control of those values; no specific malicious domain or credential target is present.