wp-plugin-security
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a defensive educational resource for developers. It correctly implements WordPress security best practices and includes remediation guidance for common vulnerabilities like XSS, CSRF, and SQL injection.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and review external, untrusted code provided by the user. This creates a potential surface for indirect prompt injection where adversarial code could attempt to influence the agent's behavior during the audit process.
- Ingestion points: External WordPress plugin/theme source code provided by users for security review (SKILL.md).
- Boundary markers: The skill relies on natural language instructions for review but does not define specific delimiters to separate user code from agent instructions.
- Capability inventory: The skill uses reasoning and analytical capabilities to identify security flaws; it does not invoke external tools, network operations, or shell commands.
- Sanitization: The skill acts as a set of conceptual guidelines and does not perform automated runtime sanitization of the input it analyzes.
Audit Metadata