The skill executes user-provided repository scripts, enabling
Claims to do
WordPress Router: Use this skill at the start of most WordPress tasks to:
Actually does
The skill executes a Node.js script (`detect_wp_project.mjs`) to analyze the current working directory (repo root). It reads the script's output to classify the WordPress project type, available tooling, and testing frameworks. It then uses this information, along with a local decision tree file (`decision-tree.md`), to determine the appropriate subsequent workflow.
npx skills add https://github.com/wordpress/agent-skillsThe agent is explicitly instructed to execute `lint`, `test`, or `build` commands found within the user's repository. This allows an attacker to embed malicious scripts in their repository, which the agent will then execute.
Run the repo’s lint/test/build commands that the triage output recommends (if available).
The skill explicitly states compatibility with `bash`, `node`, and `WP-CLI`, indicating the agent has broad capabilities to execute system commands and scripts. While necessary for its function, this presents a significant attack surface if not properly sandboxed.
compatibility: "Filesystem-based agent with bash + node. Some workflows require WP-CLI."
The agent is designed to operate on the 'Repo root (current working directory)' and inspect various configuration files, confirming its ability to read local filesystem content. This capability, while functional, could be leveraged for reconnaissance.
Inputs required: - Repo root (current working directory). ... inspect: - root composer.json, package.json, style.css, block.json, theme.json, wp-content/.
[](https://mondoo.com/ai-agent-security/skills/github/wordpress/agent-skills/wordpress-router)<a href="https://mondoo.com/ai-agent-security/skills/github/wordpress/agent-skills/wordpress-router"><img src="https://mondoo.com/ai-agent-security/api/badge/github/wordpress/agent-skills/wordpress-router.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/wordpress/agent-skills/wordpress-router.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.