wp-block-development
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill provides standard development instructions and a benign utility script for scanning WordPress blocks. No malicious behavior or high-risk patterns were detected.\n- [INDIRECT_PROMPT_INJECTION]: The
scripts/list_blocks.mjsutility scans the repository forblock.jsonfiles and extracts metadata fields like block names and titles. This data is returned to the agent's context, providing a theoretical surface for indirect prompt injection if project files contain malicious instructions.\n - Ingestion points: Block metadata (name, title, attributes) parsed from
block.jsonfiles inscripts/list_blocks.mjs.\n - Boundary markers: The output is formatted as JSON, providing structure to the data.\n
- Capability inventory: The agent has filesystem access and the ability to execute shell and Node.js commands.\n
- Sanitization: Metadata values are extracted and displayed without additional sanitization.\n- [EXTERNAL_DOWNLOADS]: The skill references official WordPress development tools such as
@wordpress/scriptsand@wordpress/env. These are well-known, trusted resources from a reputable organization and are necessary for the skill's primary function.
Audit Metadata