Skills
Navigate
skills/jeffallan/claude-skills/wordpress-pro/Gen Agent Trust Hub

wordpress-pro

Fail

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: CRITICAL
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references technical documentation hosted on the author's GitHub Pages repository at jeffallan.github.io/claude-skills/. This is a legitimate reference to the author's own project documentation.
  • [COMMAND_EXECUTION]: The instructions include standard developer commands such as phpcs for code linting and npx @wordpress/create-block for project scaffolding. These are routine utilities for the intended WordPress development workflow.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for building interfaces that process external data, such as forms and REST API endpoints. It proactively mitigates injection risks by mandating the use of WordPress security functions and nonces for all input and output operations.
  • Ingestion points: WordPress form submissions, AJAX requests, and REST API endpoints documented in SKILL.md and references/performance-security.md.
  • Boundary markers: The skill enforces WordPress Coding Standards (WPCS) and requires specific boundary protection like capability checks and nonces.
  • Capability inventory: The skill utilizes standard WordPress database operations ($wpdb) and file system access required for theme and plugin development.
  • Sanitization: Comprehensive sanitization (sanitize_text_field, wp_kses_post) and escaping (esc_html, esc_url) are required for all implementation patterns.
Recommendations
  • CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
  • Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Oct 4, 2026, 11:24 AM