block-creator

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell commands like pnpm install, wp-scripts build, and wp_cli to manage the block plugin's lifecycle, including installation, asset compilation, and plugin activation within the local environment.
  • [DYNAMIC_EXECUTION]: The skill generates and writes various project files (PHP, JavaScript, JSON, CSS) to the local filesystem and then triggers a build process to compile these assets.
  • [EXTERNAL_DOWNLOADS]: Development dependencies are fetched through standard package managers (pnpm or npm), specifically targeting @wordpress/scripts for build automation. These are standard resources for WordPress development.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user requirements to generate functional code. To mitigate risks associated with untrusted input, the instructions explicitly mandate the use of WordPress security functions, including esc_html(), esc_attr(), and wp_kses_post(), ensuring that generated content is properly sanitized.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 09:00 PM