theme-creator
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data such as design briefs and visual previews to generate WordPress theme files (SKILL.md). It lacks explicit boundary markers to delimit user instructions. The skill possesses capabilities for file system writes (generating functions.php, theme.json, and template files) and command execution (via wp_cli and studio). While a validation loop for block markup is included, it is focused on syntax rather than security sanitization of the generated code logic.
- [COMMAND_EXECUTION]: The skill uses shell commands through wp_cli for activating themes and updating site settings, and the studio tool for block validation and theme review. These are standard operations for a WordPress development tool within a local environment.
Audit Metadata