hunt-wordpress

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md, the runtime workflow uses curl to fetch arbitrary target content (e.g., HTML from $TARGET/, REST JSON from $TARGET/wp-json/..., and XML-RPC responses from $TARGET/xmlrpc.php) and then parses that returned free text via grep/jq—so outsider-authored text from the target is ingested without any requirement to preselect a specific item.