wp-plugin-cve-hunt

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document explicitly instructs scanning and exploitation of WordPress plugins (including SQLi payloads, REST/AJAX enumeration, and uploading a shell.php), which are actionable steps to achieve RCE/backdoors and system compromise — indicating deliberate malicious/abusive intent.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow in SKILL.md reads outsider-authored free text from user-supplied target domains at runtime (e.g., it curls /wp-content/plugins//readme.txt, plugin PHP headers, HTML sources, and wp-json endpoints, all of which can contain attacker-controlled content such as injected version strings or JSON fields).