wp-abilities-api
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to search the repository for existing PHP and JavaScript code patterns related to the Abilities API.
- Ingestion points: Repository files searched for strings like
wp_register_abilityandwp-abilities/v1inSKILL.md(Step 2). - Boundary markers: The instructions do not specify using delimiters or warnings to ignore malicious instructions within the source code being analyzed.
- Capability inventory: The agent is tasked with writing new registration logic and using WP-CLI/Node.js based on the search results.
- Sanitization: No explicit sanitization of discovered code is required before using it as a template for new registrations.
- [COMMAND_EXECUTION]: The skill requires the use of bash and WP-CLI for certain workflows, which is standard for WordPress development and maintenance environments.
- [EXTERNAL_DOWNLOADS]: The skill references the
@wordpress/abilitiespackage, which is an official package maintained by the WordPress organization.
Audit Metadata