wordpress-theme-to-emdash
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download WordPress theme files from the official repository (wordpress.org) and images from theme demo sites for development purposes. These operations are necessary for the skill's primary function and target well-known or user-specified resources.
- [INDIRECT_PROMPT_INJECTION]: The skill involves processing external, potentially untrusted data by browsing live WordPress demo sites and reading third-party theme source code. This creates an attack surface where instructions embedded in those external sources could attempt to influence agent behavior.
- Ingestion points: Browser content via
agent-browser, downloaded theme ZIP files (style.css,functions.php,theme.json), and images. - Boundary markers: The skill does not explicitly define prompt delimiters for external content but relies on the agent's internal analysis and mapping logic.
- Capability inventory: File writing, network access (curl, agent-browser), and local project execution (
pnpm dev). - Sanitization: The instructions emphasize manual inventory and mapping of WordPress concepts to Astro components rather than direct execution of the source code.
Audit Metadata