wordpress-admin

The static analyzer flagged 151 potential issues, but evaluation reveals most are false positives. The skill uses subprocess.run for legitimate WordPress management via WP-CLI and Docker. Hardcoded URLs are configuration values, not suspicious network connections. The SKILL.md backtick patterns are markdown documentation, not shell execution. The 'weak cryptographic algorithm' flags are false positives from meta field names containing underscores. The combination of code execution, network access, and credential handling is expected for a WordPress administration skill. All operations are within the explicitly declared allowed-tools scope.