Skills
Navigate
skills/automattic/wordpress-agent-skills/wordpress-block-theming/Gen Agent Trust Hub

wordpress-block-theming

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides code templates to enqueue typography assets from Google's official fonts service (fonts.googleapis.com).
  • [DYNAMIC_EXECUTION]: The skill includes instructions and templates for generating inline JavaScript within the functions.php file to handle scroll-based animations using the IntersectionObserver API.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest user-provided content (site descriptions, image URLs, and branding preferences) to generate theme files, representing a potential surface for indirect prompt injection. However, the skill provides explicit instructions to sanitize and escape any dynamic output using WordPress security functions like esc_html, esc_attr, and esc_url.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 08:00 PM
Security Audit — agent-trust-hub — wordpress-block-theming