wp-block-development
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides comprehensive guidance for WordPress Gutenberg block development, adhering to official best practices and using standard tools. No malicious patterns were detected in the instructions or scripts.
- [INDIRECT_PROMPT_INJECTION]: The skill processes
block.jsonfiles from the local filesystem to summarize block metadata for the agent. This represents a standard surface for processing project-specific data. - Ingestion points: The
scripts/list_blocks.mjsscript reads and parsesblock.jsonfiles found within the local repository. - Boundary markers: The script parses file content as structured JSON, reducing the risk of accidental instruction following, though no explicit delimiters are added to the summarized output provided to the agent.
- Capability inventory: The skill is configured to run local build tools, Node.js scripts, and WordPress CLI commands. It does not possess network exfiltration or arbitrary remote code execution capabilities.
- Sanitization: Files are processed using
JSON.parse(), which ensures only valid data structures are extracted and prevents the execution of raw file content during the triage and scanning phase.
Audit Metadata