wordpress-penetration-testing

High-risk offensive security skill. Its capabilities are aligned with its stated WordPress penetration-testing purpose, and the referenced tools are largely official/open-source, but the skill materially increases attack capability by guiding credential attacks, exploitation, shell upload, and proxy-assisted probing. No clear credential harvesting or third-party exfiltration is present, so this is not confirmed malware, but it is dangerous and disproportionate for general agent use.

This fragment is security-testing documentation, not code that autonomously performs malicious actions. It contains actionable WordPress enumeration, brute-force, exploitation, command-execution webshell, and reverse-shell examples that could compromise a target if used without authorization; it also includes authorization and cleanup safeguards. No actual credentials or suspicious external domains are shown. Severity is elevated for misuse potential, but the fragment alone does not establish package malware.