wp-wpcli-and-ops

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a utility script scripts/wpcli_inspect.mjs that uses node:child_process.spawnSync to execute wp (WP-CLI) commands. This is used for environment discovery and validation. The execution uses array-based arguments, which is a secure practice to prevent shell injection.
  • [SAFE]: The skill places a heavy emphasis on operational safety. It includes a dedicated references/safety.md file and multiple instructions requiring the agent to confirm the environment (development vs. production), perform database backups (wp db export), and use --dry-run flags for destructive operations like search-replace.
  • [SAFE]: No unauthorized network operations, data exfiltration patterns, or hardcoded credentials were found. The skill operates locally on the provided WordPress path using the existing environment's WP-CLI installation.
  • [SAFE]: The automation and scripting guidelines provided in references/automation.md promote best practices such as using set -euo pipefail in shell scripts to ensure execution stops on errors.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 20, 2026, 03:15 AM
Security Audit — agent-trust-hub — wp-wpcli-and-ops