The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides detailed instructions and Python code to create and update 'Page Blocks' that can execute arbitrary PHP code on the server.
Evidence includes documentation of the php_exec database column and the REST API field php_exec: boolean used to enable server-side execution.
It describes a mechanism where PHP is executed via temporary file inclusion if a specific constant (MD_ALLOW_PHP_SNIPPETS) is enabled in the WordPress configuration.
[DYNAMIC_EXECUTION]: The skill facilitates the injection of arbitrary JavaScript into WordPress pages.
It documents js and js_location fields that allow scripts to be placed in the site's footer or inline within the content.
This creates a persistent Stored Cross-Site Scripting (XSS) vector if the content is not strictly controlled.
[COMMAND_EXECUTION]: The skill provides functional Python snippets using the requests library to perform high-privilege administrative actions on a remote WordPress site, including modifying executable content and display conditions.
[INDIRECT_PROMPT_INJECTION]: The skill defines a large attack surface for indirect injection by ingesting HTML, CSS, and JS into page templates.
Ingestion points: Content, CSS, and JS fields processed via the md/v1/page-blocks REST API as seen in SKILL.md.
Boundary markers: None identified; instructions do not include delimiters or warnings to ignore embedded instructions in the generated content.
Capability inventory: The skill allows for writing files (implicitly via the WordPress DB/File system), executing PHP, and executing JavaScript.
Sanitization: No explicit sanitization or validation of the HTML/JS/PHP content is mentioned before it is pushed to the remote server.

page-block