roots-ecosystem
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill serves as a comprehensive reference for the Roots WordPress ecosystem, providing developers with structural guidance and operational playbooks without including any executable code.
- [EXTERNAL_DOWNLOADS]: The skill documentation references the installation of legitimate ecosystem packages and project starters, such as roots/bedrock and roots/wordpress-full, via the Composer package manager. It also provides guidance on using the official roots/setup-trellis-cli GitHub Action for automation.
- [INDIRECT_PROMPT_INJECTION]: The skill involves the agent reading project-specific files like composer.json, .env, and theme configuration to provide relevant support. This is a standard architectural requirement for development assistance and is managed through structured task-specific playbooks.
- [COMMAND_EXECUTION]: The playbooks describe the use of standard ecosystem CLI tools such as wp acorn and trellis-cli for routine development tasks like scaffolding components, running migrations, and managing deployments.
Audit Metadata