wp-playground
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
npx @wp-playground/clito manage local WordPress servers, execute blueprints, and build site snapshots. This is the standard and official distribution method for the WordPress Playground CLI. - [EXTERNAL_DOWNLOADS]: The skill facilitates downloading WordPress blueprints, themes, and plugins from remote URLs. Documentation and examples point toward official WordPress repositories and domains (e.g., downloads.wordpress.org).
- [REMOTE_CODE_EXECUTION]: The WordPress Blueprint specification (referenced in the skill) allows for a
runPHPstep, which executes PHP code within the isolated WebAssembly-based WordPress environment. This is a core architectural feature for scripted setup and testing. - [DATA_EXPOSURE]: The skill allows mounting host directories into the virtualized environment via the
--auto-mountand--mountflags. It proactively includes security guardrails advising users to ensure mounted directories do not contain secrets and to avoid using production data, as the environment operates in an ephemeral, in-memory filesystem.
Audit Metadata