wordpress-plugin-core
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill provides highly structured templates for Simple, OOP, and PSR-4 WordPress plugin development. All examples correctly implement core security features including ABSPATH checks, unique prefixing, and nonce verification for both AJAX and REST API endpoints.
- [EXTERNAL_DOWNLOADS]: The documentation references the
YahnisElsts/plugin-update-checkerlibrary for implementing automatic updates from GitHub. The instructions guide the user to integrate this well-known library using standard development tools like Composer or Git submodules. - [COMMAND_EXECUTION]: Includes
scripts/scaffold-plugin.sh, a helper script that uses common shell commands (cp,mv,sed) to automate the creation of plugin project structures. The script operates within the developer's local environment to customize templates. - [SAFE]: Database patterns in
SKILL.mdemphasize the use of$wpdb->prepare()to prevent SQL injection, correctly highlighting that table names should not be used as placeholders to avoid syntax errors. - [SAFE]: Mentions of WordPress 6.8 and 6.9 features (like bcrypt migration and WP_Dependencies deprecation) serve as educational content for maintaining plugin compatibility and do not involve any malicious execution logic.
Audit Metadata