wp-github-actions
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill facilitates the creation of GitHub Actions workflows using well-known and community-standard actions, including those from the official WordPress organization and 10up, a reputable WordPress agency. These external resources are standard for the intended task and are used for their intended primary purpose.
- [SAFE]: The skill correctly identifies the need for sensitive information (SVN credentials) and instructs the agent to guide users on storing these securely as GitHub Repository Secrets, effectively preventing credential exposure.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes the repository structure and manifests (like composer.json or package.json) to recommend relevant workflows. This creates a small attack surface for indirect prompt injection, but the risk is mitigated because the skill's capabilities are limited to generating static YAML configuration files from safe, predefined templates.
- Ingestion points: Repository root file listing and manifest files (composer.json, package.json).
- Boundary markers: N/A (the skill uses internal logic rather than prompt interpolation).
- Capability inventory: File system write access to create YAML files in .github/workflows/.
- Sanitization: The skill uses hardcoded templates for workflow generation, minimizing the influence of external repository data on the final output structure.
Audit Metadata