wordpress-pro
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill enforces strict adherence to WordPress Coding Standards (WPCS) and requires the use of nonces, sanitization, and escaping in all generated code snippets and implementations.
- [SAFE]: No evidence of obfuscation, hardcoded credentials, or unauthorized data exfiltration was found across the skill body or its reference documentation.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a code generation assistant, creating a surface for indirect prompt injection via user-provided requirements. This risk is effectively mitigated by the skill's core constraints that mandate security hardening and manual verification of capability checks and sanitization logic.
- [REMOTE_CODE_EXECUTION]: While reference documentation includes examples of an update checker that fetches remote JSON, these are standard development patterns for self-hosted plugins and utilize placeholder domains (example.com), presenting no immediate threat to the environment.
Audit Metadata