block-creator
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands like
pnpm install,wp-scripts build, andwp_clito manage the block plugin's lifecycle, including installation, asset compilation, and plugin activation within the local environment. - [DYNAMIC_EXECUTION]: The skill generates and writes various project files (PHP, JavaScript, JSON, CSS) to the local filesystem and then triggers a build process to compile these assets.
- [EXTERNAL_DOWNLOADS]: Development dependencies are fetched through standard package managers (
pnpmornpm), specifically targeting@wordpress/scriptsfor build automation. These are standard resources for WordPress development. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user requirements to generate functional code. To mitigate risks associated with untrusted input, the instructions explicitly mandate the use of WordPress security functions, including
esc_html(),esc_attr(), andwp_kses_post(), ensuring that generated content is properly sanitized.
Audit Metadata