Histórico de auditoria

System reconnaissance

WHERE post_id = {id} AND meta_key = '_yoast_wpseo_metadesc';

The documentation shows a direct SQL update with an interpolated meta description. This bypasses WordPress APIs and can corrupt data or enable SQL injection if copied.

Médio

Network reconnaissance

- Upload to WordPress

This directs the agent to upload media to WordPress as part of an auto-fix flow. It is a state-changing network operation that needs explicit authorization and scope limits.

Médio

audit.py:24-28

Hard-Coded Database Credentials

audit.py defines the WordPress database container, user, password, and database name in source code.

The credential constants are plainly defined in the script. They appear to be local defaults, but publishing them still encourages credential reuse and privileged database access.

Médio

SKILL.md:122-126

State-Changing Auto-Fix Workflow Without Safeguards

The skill describes uploading images, setting featured media, and updating meta descriptions without requiring dry runs, backups, or explicit confirmation.

The workflow is explicitly state-changing and affects live WordPress content. The file does not document approval gates or rollback safeguards for those changes.

Baixo

audit.py:123

System reconnaissance

page_id = page['id']

This assigns an ID from REST API data that is later used in SQL query construction. The risk is indirect and depends on untrusted API data, so confidence is moderate.

Itens de revisão de capacidade (4)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

Python subprocess.run

result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)

This runs docker exec mysql against a local WordPress database with hard-coded credentials and generated SQL. shell=False reduces command injection risk, but the command grants database read access and uses unparameterized queries.

Alto

Python subprocess.run

result = subprocess.run(

This launches curl against a URL derived from the base URL argument. It is not shell injection, but it enables arbitrary outbound requests from the agent environment.

Médio

Hidden file access

Uses the Unsplash MCP server configured at `/root/.claude/.mcp.json`:

The skill references a root-owned hidden Claude MCP configuration path. Such files may contain server configuration or tokens and should not be assumed by a marketplace skill.

Baixo

audit.py:39 audit.py:94 SKILL.md:50-55 SKILL.md:55-58 SKILL.md:58-63 SKILL.md:63-66 SKILL.md:66-72 SKILL.md:72-75 SKILL.md:75-83 SKILL.md:83-94 SKILL.md:94-120 SKILL.md:120-130 SKILL.md:130-138 SKILL.md:138-167

Hardcoded URL

parser.add_argument('--base-url', type=str, default='https://local2.hustletogether.com',

The default base URL points to a real external WordPress site. Running the script without an explicit base URL will contact that site.

Fatores de risco

⚙️ Comandos externos (14)

🌐 Acesso à rede (8)

audit.py:11 audit.py:12 audit.py:13 audit.py:355 SKILL.md:171 SKILL.md:172 SKILL.md:173 SKILL.md:174

📁 Acesso ao sistema de arquivos (1)

Padrões detectados

System reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceNetwork reconnaissance

Auditado por: codex

Versão da auditoria 9

9 de jul. de 2026, 11:17

The skill has legitimate WordPress SEO audit behavior, but it also executes local Docker and curl commands, queries the database directly, and references hidden Claude configuration. No prompt injection was found, but the database access and auto-fix guidance require safeguards before broad marketplace publication.

2

Arquivos analisados

574

Linhas analisadas

15

Itens de revisão

0

Falsos positivos ignorados

Preocupações de segurança confirmadas (8)

Alto

SKILL.md:74-82

Direct Database Write Guidance

SKILL.md recommends direct WordPress database access and shows an UPDATE statement with interpolated values.

The documented workflow bypasses WordPress APIs and uses string-style placeholders in SQL. This creates clear data integrity and injection risk if automated.

Médio

audit.py:55

System reconnaissance

WHERE post_id = {post_id}

The post_id value is interpolated directly into a SQL query sent to mysql. It normally comes from WordPress page IDs, but the script does not validate it before query construction.

Médio

SKILL.md:78

System reconnaissance

WHERE post_id = {id} AND meta_key = '_yoast_wpseo_focuskw';

The documentation shows direct SQL using an interpolated post ID. This can encourage unsafe database access when copied into automation.

Médio

System reconnaissance

WHERE post_id = {id} AND meta_key = '_yoast_wpseo_metadesc';

The documentation shows a direct SQL update with an interpolated meta description. This bypasses WordPress APIs and can corrupt data or enable SQL injection if copied.

Médio

Network reconnaissance

- Upload to WordPress

This directs the agent to upload media to WordPress as part of an auto-fix flow. It is a state-changing network operation that needs explicit authorization and scope limits.

Médio

audit.py:24-28

Hard-Coded Database Credentials

audit.py defines the WordPress database container, user, password, and database name in source code.

The credential constants are plainly defined in the script. They appear to be local defaults, but publishing them still encourages credential reuse and privileged database access.

Médio

SKILL.md:122-126

State-Changing Auto-Fix Workflow Without Safeguards

The skill describes uploading images, setting featured media, and updating meta descriptions without requiring dry runs, backups, or explicit confirmation.

The workflow is explicitly state-changing and affects live WordPress content. The file does not document approval gates or rollback safeguards for those changes.

Baixo

audit.py:123

System reconnaissance

page_id = page['id']

This assigns an ID from REST API data that is later used in SQL query construction. The risk is indirect and depends on untrusted API data, so confidence is moderate.

Itens de revisão de capacidade (4)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

Python subprocess.run

result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)

This runs docker exec mysql against a local WordPress database with hard-coded credentials and generated SQL. shell=False reduces command injection risk, but the command grants database read access and uses unparameterized queries.

Alto

Python subprocess.run

result = subprocess.run(

This launches curl against a URL derived from the base URL argument. It is not shell injection, but it enables arbitrary outbound requests from the agent environment.

Médio

Hidden file access

Uses the Unsplash MCP server configured at `/root/.claude/.mcp.json`:

The skill references a root-owned hidden Claude MCP configuration path. Such files may contain server configuration or tokens and should not be assumed by a marketplace skill.

Baixo

audit.py:39 audit.py:94 SKILL.md:50-55 SKILL.md:55-58 SKILL.md:58-63 SKILL.md:63-66 SKILL.md:66-72 SKILL.md:72-75 SKILL.md:75-83 SKILL.md:83-94 SKILL.md:94-120 SKILL.md:120-130 SKILL.md:130-138 SKILL.md:138-167

Hardcoded URL

parser.add_argument('--base-url', type=str, default='https://local2.hustletogether.com',

The default base URL points to a real external WordPress site. Running the script without an explicit base URL will contact that site.

Fatores de risco

⚙️ Comandos externos (14)

🌐 Acesso à rede (8)

audit.py:11 audit.py:12 audit.py:13 audit.py:355 SKILL.md:171 SKILL.md:172 SKILL.md:173 SKILL.md:174

📁 Acesso ao sistema de arquivos (1)

Padrões detectados

System reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceNetwork reconnaissance

Auditado por: codex

Versão da auditoria 8

5 de jul. de 2026, 07:56

The audit confirms real risk from external command execution, direct WordPress database access, a hardcoded default site URL, and a hidden Claude MCP configuration reference. Many Markdown fences, documentation links, and WordPress metadata references are false positives rather than shell execution or system reconnaissance. No prompt injection attempt was found in the reviewed files.

2

Arquivos analisados

574

Linhas analisadas

9

Itens de revisão

0

Falsos positivos ignorados

Preocupações de segurança confirmadas (2)

Médio

System reconnaissance

WHERE post_id = {id} AND meta_key = '_yoast_wpseo_metadesc';

The SQL example writes wp_postmeta directly with an interpolated description value. This bypasses WordPress and plugin validation and can modify site content metadata.

Médio

Network reconnaissance

- Upload to WordPress

The Unsplash workflow includes uploading downloaded media to WordPress. It is not reconnaissance, but it is a network write and site modification that needs explicit user approval.

Itens de revisão de capacidade (4)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

Python subprocess.run

result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)

The script executes docker and mysql through subprocess.run with local database credentials. Arguments are not shell-expanded, but the skill gains direct WordPress database access through an external command.

Alto

Python subprocess.run

result = subprocess.run(

The script invokes curl through subprocess.run against a URL derived from the base URL argument. This creates arbitrary outbound network access through an external command.

Médio

Hidden file access

Uses the Unsplash MCP server configured at `/root/.claude/.mcp.json`:

The skill references /root/.claude/.mcp.json, a hidden Claude configuration path that may contain MCP server configuration or credentials. Marketplace skills should not rely on or direct access to private root-level config files.

Baixo

audit.py:39 audit.py:94 SKILL.md:50-55 SKILL.md:55-58 SKILL.md:58-63 SKILL.md:63-66 SKILL.md:66-72 SKILL.md:72-75 SKILL.md:75-83 SKILL.md:83-94 SKILL.md:94-120 SKILL.md:120-130 SKILL.md:130-138 SKILL.md:138-167

Hardcoded URL

parser.add_argument('--base-url', type=str, default='https://local2.hustletogether.com',

The CLI default base URL points to a specific WordPress host. Running the script without an explicit base URL will contact that site.

Fatores de risco

⚙️ Comandos externos (14)

🌐 Acesso à rede (8)

audit.py:11 audit.py:12 audit.py:13 audit.py:355 SKILL.md:171 SKILL.md:172 SKILL.md:173 SKILL.md:174

📁 Acesso ao sistema de arquivos (1)

Padrões detectados

System reconnaissanceNetwork reconnaissance

Auditado por: codex

Versão da auditoria 7

5 de jul. de 2026, 07:56

The audit confirms real risk from external command execution, direct WordPress database access, a hardcoded default site URL, and a hidden Claude MCP configuration reference. Many Markdown fences, documentation links, and WordPress metadata references are false positives rather than shell execution or system reconnaissance. No prompt injection attempt was found in the reviewed files.

2

Arquivos analisados

574

Linhas analisadas

9

Itens de revisão

0

Falsos positivos ignorados

Preocupações de segurança confirmadas (2)

Médio

System reconnaissance

WHERE post_id = {id} AND meta_key = '_yoast_wpseo_metadesc';

The SQL example writes wp_postmeta directly with an interpolated description value. This bypasses WordPress and plugin validation and can modify site content metadata.

Médio

Network reconnaissance

- Upload to WordPress

The Unsplash workflow includes uploading downloaded media to WordPress. It is not reconnaissance, but it is a network write and site modification that needs explicit user approval.

Itens de revisão de capacidade (4)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

Python subprocess.run

result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)

The script executes docker and mysql through subprocess.run with local database credentials. Arguments are not shell-expanded, but the skill gains direct WordPress database access through an external command.

Alto

Python subprocess.run

result = subprocess.run(

The script invokes curl through subprocess.run against a URL derived from the base URL argument. This creates arbitrary outbound network access through an external command.

Médio

Hidden file access

Uses the Unsplash MCP server configured at `/root/.claude/.mcp.json`:

The skill references /root/.claude/.mcp.json, a hidden Claude configuration path that may contain MCP server configuration or credentials. Marketplace skills should not rely on or direct access to private root-level config files.

Baixo

audit.py:39 audit.py:94 SKILL.md:50-55 SKILL.md:55-58 SKILL.md:58-63 SKILL.md:63-66 SKILL.md:66-72 SKILL.md:72-75 SKILL.md:75-83 SKILL.md:83-94 SKILL.md:94-120 SKILL.md:120-130 SKILL.md:130-138 SKILL.md:138-167

Hardcoded URL

parser.add_argument('--base-url', type=str, default='https://local2.hustletogether.com',

The CLI default base URL points to a specific WordPress host. Running the script without an explicit base URL will contact that site.

Fatores de risco

⚙️ Comandos externos (14)

🌐 Acesso à rede (8)

audit.py:11 audit.py:12 audit.py:13 audit.py:355 SKILL.md:171 SKILL.md:172 SKILL.md:173 SKILL.md:174

📁 Acesso ao sistema de arquivos (1)

Padrões detectados

System reconnaissanceNetwork reconnaissance

Auditado por: codex

Versão da auditoria 6

29 de jun. de 2026, 02:48

Static analysis reported many high-risk weak-cryptography matches, but those are false positives caused by SEO terms and report labels. Confirmed concerns are external command execution, WordPress database access, network requests, and a hidden Claude MCP config reference; no malicious intent or prompt injection was found.

2

Arquivos analisados

574

Linhas analisadas

8

Itens de revisão

2

Falsos positivos ignorados

Itens de revisão de capacidade (4)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Médio

audit.py:24-39 SKILL.md:74-83

External Command Execution for Docker and Curl

TRUE_POSITIVE: audit.py invokes docker exec mysql and curl through subprocess.run. The calls use argument arrays and do not use shell=True, so command injection evidence is limited, but running local containers and fetching URLs is sensitive behavior for a marketplace skill.

The subprocess.run calls are direct and confirmed. Confidence is not higher because arguments are not passed through a shell and the behavior appears related to the stated SEO audit purpose.

Médio

Direct WordPress Database Access with Hardcoded Local Credentials

TRUE_POSITIVE: audit.py stores local WordPress database connection values and runs SQL through docker exec mysql. The script performs SELECT queries, while SKILL.md also documents direct SQL update patterns, which can bypass WordPress permission checks if followed.

The hardcoded database settings and direct SQL execution are explicit. The highest impact update behavior is documented in SKILL.md rather than implemented in audit.py.

Médio

SKILL.md:128-134

Hidden Claude MCP Configuration Path Referenced

TRUE_POSITIVE: SKILL.md tells users the Unsplash MCP server is configured at /root/.claude/.mcp.json. Hidden agent configuration files can contain connector details or credentials, so marketplace users should review this requirement before use.

The hidden configuration path is explicitly referenced. I did not find code that reads or exfiltrates the file, so the concern is configuration exposure and operational sensitivity.

Baixo

audit.py:91-104 SKILL.md:171-174

Network Access Is Required for WordPress and SEO Resources

TRUE_POSITIVE: audit.py fetches WordPress REST API data with curl, and SKILL.md references external documentation and Unsplash usage. No evidence found of credential exfiltration or covert network destinations.

Network behavior is clear from curl and external URLs. The risk is limited because the endpoints are user-supplied WordPress URLs or documentation links.

Falsos positivos estáticos ignorados (2)

Estas correspondências estáticas foram descartadas pela revisão semântica ou corresponderam a tokens apenas de esquema, portanto são exibidas para transparência, mas não afetam a pontuação de qualidade.

Baixo

audit.py:183-213 SKILL.md:20-37

Weak Cryptography Static Matches Dismissed

FALSE_POSITIVE: the many weak cryptography matches appear to be triggered by SEO words such as meta description, markdown examples, output status labels, and display symbols. No hashing, encryption, MD5, SHA-1, or other cryptographic implementation was found.

The cited areas are SEO description checks and skill documentation. I found no cryptographic API usage in the reviewed files.

Baixo

SKILL.md:49-83 SKILL.md:93-120 SKILL.md:136-167

Markdown Code Fence Command Matches Dismissed

FALSE_POSITIVE: the SKILL.md backtick findings are markdown code fences for meta keys, REST endpoints, example SQL, JSON-shaped reports, and sample output. They are not Ruby or shell backtick execution.

The matched lines are visibly fenced documentation examples. They are not executable code paths.

Fatores de risco

⚡ Contém scripts (1)

audit.py:1-14

⚙️ Comandos externos (2)

audit.py:91-104 audit.py:355-356 SKILL.md:171 SKILL.md:172 SKILL.md:173 SKILL.md:174

🌐 Acesso à rede (6)

📁 Acesso ao sistema de arquivos (1)

Padrões detectados

subprocess.run Executes Local ProgramsDirect Database Query ConstructionHidden Agent Configuration Reference

Auditado por: codex

Versão da auditoria 5

16 de jan. de 2026, 23:57

Legitimate WordPress SEO audit tool with necessary external commands for Docker and network access. Most scanner findings are false positives (SEO meta keys misinterpreted as cryptographic terms). Existing audit identified SQL injection vulnerability requiring code fix. Hardcoded database credentials present for local dev only.

3

Arquivos analisados

856

Linhas analisadas

6

Itens de revisão

0

Falsos positivos ignorados

Itens de revisão de capacidade (3)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

SQL Injection Vulnerability

Database queries use f-string interpolation without sanitization. Lines 53-62 and 73-79 directly interpolate post_id into queries. While post_id comes from WordPress API (trusted source), this is still poor security practice.

Médio

Hardcoded Database Credentials

Database credentials are hardcoded in plain text at lines 25-28. DB_PASS = 'wordpress' appears in command line arguments visible in process listings. Should use environment variables.

Baixo

Command Line Password Exposure

Password passed on docker exec command line at line 36. Visible in process listings. Consider using stdin or environment variables.

Fatores de risco

⚡ Contém scripts (1)

🌐 Acesso à rede (2)

⚙️ Comandos externos (2)

Auditado por: claude

Versão da auditoria 4

16 de jan. de 2026, 23:57

Legitimate WordPress SEO audit tool with necessary external commands for Docker and network access. Most scanner findings are false positives (SEO meta keys misinterpreted as cryptographic terms). Existing audit identified SQL injection vulnerability requiring code fix. Hardcoded database credentials present for local dev only.

3

Arquivos analisados

856

Linhas analisadas

6

Itens de revisão

0

Falsos positivos ignorados

Itens de revisão de capacidade (3)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

SQL Injection Vulnerability

Database queries use f-string interpolation without sanitization. Lines 53-62 and 73-79 directly interpolate post_id into queries. While post_id comes from WordPress API (trusted source), this is still poor security practice.

Médio

Hardcoded Database Credentials

Database credentials are hardcoded in plain text at lines 25-28. DB_PASS = 'wordpress' appears in command line arguments visible in process listings. Should use environment variables.

Baixo

Command Line Password Exposure

Password passed on docker exec command line at line 36. Visible in process listings. Consider using stdin or environment variables.

Fatores de risco

⚡ Contém scripts (1)

🌐 Acesso à rede (2)

⚙️ Comandos externos (2)

Auditado por: claude

Versão da auditoria 3

10 de jan. de 2026, 12:51

Legitimate WordPress SEO audit tool with necessary external commands for Docker and network access. Contains SQL injection vulnerability in database queries that requires patching. Hardcoded credentials are present but for local dev only.

2

Arquivos analisados

584

Linhas analisadas

7

Itens de revisão

0

Falsos positivos ignorados

Itens de revisão de capacidade (3)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

SQL Injection Vulnerability

Database queries use f-string interpolation without sanitization, allowing SQL injection attacks if user-controlled input reaches post_id. At line 53-62, the query directly interpolates post_id: 'WHERE post_id = {post_id}'. An attacker controlling page data could inject SQL. Code: query = f"SELECT meta_key, meta_value FROM wp_postmeta WHERE post_id = {post_id} AND meta_key IN..."

Médio

Hardcoded Database Credentials

Database credentials are hardcoded in plain text at lines 25-28: DB_PASS = "wordpress". While these appear to be local dev credentials, hardcoded credentials are a security anti-pattern that could be exploited if this code runs in production.

Baixo

Command Injection Surface

The script executes subprocess.run with shell=False (lines 34-39, 94-99), which is the safer approach. However, the docker exec command includes password on command line, exposing it in process listings. Consider using environment variables or stdin for password passing.

Fatores de risco

⚡ Contém scripts (1)

🌐 Acesso à rede (2)

📁 Acesso ao sistema de arquivos (1)

audit.py:22

⚙️ Comandos externos (2)

Auditado por: claude

Versão da auditoria 2

10 de jan. de 2026, 12:51

Legitimate WordPress SEO audit tool with necessary external commands for Docker and network access. Contains SQL injection vulnerability in database queries that requires patching. Hardcoded credentials are present but for local dev only.

2

Arquivos analisados

584

Linhas analisadas

7

Itens de revisão

0

Falsos positivos ignorados

Itens de revisão de capacidade (3)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

SQL Injection Vulnerability

Database queries use f-string interpolation without sanitization, allowing SQL injection attacks if user-controlled input reaches post_id. At line 53-62, the query directly interpolates post_id: 'WHERE post_id = {post_id}'. An attacker controlling page data could inject SQL. Code: query = f"SELECT meta_key, meta_value FROM wp_postmeta WHERE post_id = {post_id} AND meta_key IN..."

Médio

Hardcoded Database Credentials

Database credentials are hardcoded in plain text at lines 25-28: DB_PASS = "wordpress". While these appear to be local dev credentials, hardcoded credentials are a security anti-pattern that could be exploited if this code runs in production.

Baixo

Command Injection Surface

The script executes subprocess.run with shell=False (lines 34-39, 94-99), which is the safer approach. However, the docker exec command includes password on command line, exposing it in process listings. Consider using environment variables or stdin for password passing.

Fatores de risco

⚡ Contém scripts (1)

🌐 Acesso à rede (2)

📁 Acesso ao sistema de arquivos (1)

audit.py:22

⚙️ Comandos externos (2)

Auditado por: claude

Versão da auditoria 1

10 de jan. de 2026, 12:51

Legitimate WordPress SEO audit tool with necessary external commands for Docker and network access. Contains SQL injection vulnerability in database queries that requires patching. Hardcoded credentials are present but for local dev only.

2

Arquivos analisados

584

Linhas analisadas

7

Itens de revisão

0

Falsos positivos ignorados

Itens de revisão de capacidade (3)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

SQL Injection Vulnerability

Database queries use f-string interpolation without sanitization, allowing SQL injection attacks if user-controlled input reaches post_id. At line 53-62, the query directly interpolates post_id: 'WHERE post_id = {post_id}'. An attacker controlling page data could inject SQL. Code: query = f"SELECT meta_key, meta_value FROM wp_postmeta WHERE post_id = {post_id} AND meta_key IN..."

Médio

Hardcoded Database Credentials

Database credentials are hardcoded in plain text at lines 25-28: DB_PASS = "wordpress". While these appear to be local dev credentials, hardcoded credentials are a security anti-pattern that could be exploited if this code runs in production.

Baixo

Command Injection Surface

The script executes subprocess.run with shell=False (lines 34-39, 94-99), which is the safer approach. However, the docker exec command includes password on command line, exposing it in process listings. Consider using environment variables or stdin for password passing.

Fatores de risco

⚡ Contém scripts (1)

🌐 Acesso à rede (2)

📁 Acesso ao sistema de arquivos (1)

audit.py:22

⚙️ Comandos externos (2)