wp-plugin-development
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides structured guidance and educational references for building WordPress plugins according to official development standards. It includes comprehensive instructions on security mechanisms like nonces, capability checks, and prepared SQL statements.
- [SAFE]: The
scripts/detect_plugins.mjsutility performs read-only filesystem operations to identify WordPress plugin headers. The script incorporates safety guards, including recursion depth limits and a maximum file count, to prevent excessive resource consumption. - [INDIRECT_PROMPT_INJECTION]: The skill includes an ingestion surface where it reads and parses headers from third-party PHP files. While this creates a theoretical opportunity for an attacker to embed instructions in a plugin's metadata, the risk is minimal as the data is parsed into structured JSON and the skill's primary focus is on secure code review and development.
Audit Metadata