wp-plugin-rest-auth-bypass

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document explicitly instructs and automates exploiting unauthenticated WordPress plugin REST endpoints to publish content, modify settings, and leak admin/user data — clearly malicious and intended for unauthorized access and data exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime workflow ingests free text from an outside-authored source by accepting arbitrary TARGET/BASE via user input (sys.argv/BASE) and then LLM-proxying the responses (r.text/r.json() and extracted args) from the target’s /wp-json/ REST API endpoints into its decision/exploitation logic.