The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses wp eval to execute PHP code within the local WordPress environment. This capability is used to update custom post metadata fields directly in the database.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it retrieves Twig templates and HTML from the WordPress database to perform conversion and transformation tasks. Ingestion points include reading template content via wp post meta get. No boundary markers or sanitization steps are used when the agent processes this external data. The skill's capability inventory includes shell execution via the Bash tool and PHP execution via wp eval, which could be exploited if malicious instructions are embedded in the processed database content.

canai-localwp