wpscan

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill's command examples include passing an API token as a direct command-line argument (e.g., --api-token ) and credential-related commands, which encourage embedding secrets verbatim in generated commands/outputs and thus pose a high exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill is a WPScan procedure that runs a scanner against a user-supplied “Confirmed WordPress URL”; at runtime the tool will fetch and parse outsider-authored web page content from that URL (public/target site responses) into the agent’s context as scan results, which is an indirect prompt-injection exposure path.