The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install external binaries from author-owned repositories. Specifically, it uses npx -y @mvanhorn/printing-press-library and go install github.com/mvanhorn/printing-press-library/.... These resources are consistent with the identified author context.
[COMMAND_EXECUTION]: The skill is primarily a wrapper for the wordpress-pp-cli binary. It also executes installation commands such as npx and go install to set up its environment.
[DATA_EXFILTRATION]: The skill includes a --deliver webhook:<url> feature that allows the output of any CLI command to be sent to an external HTTP endpoint. While a documented feature, this provides a mechanism for data exfiltration if an attacker-controlled URL is provided as an argument.
[DYNAMIC_EXECUTION]: The 'Automatic learning' loop uses a playbook system where shell commands stored in a local SQLite database are replayed with slot substitution (Playbook.steps). This is a dynamic execution surface where command choreography is derived from previous sessions.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it processes untrusted content from external WordPress sites (posts, media, route tables) which could contain malicious instructions intended to influence the agent's behavior during the 'diagnose' or 'learning' phases.
Ingestion points: Data retrieved via WordPress REST API endpoints (e.g., posts list, media get, schema).
Boundary markers: The CLI uses a JSON provenance envelope (meta and results keys) to separate metadata from site data, but does not specify delimiters for content within the results themselves.
Capability inventory: The associated CLI can perform write/delete operations on WordPress sites, execute local playbooks, and send data to external webhooks.
Sanitization: The skill suggests using a --select flag to reduce the volume of data in the agent's context, but does not detail content-level sanitization or escaping mechanisms.

pp-wordpress