wp-plugin-development
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides structured guidelines for auditing WordPress plugin code, focusing on architecture, lifecycle hooks, and standard compliance. No malicious code, exfiltration attempts, or prompt injections are present in the documentation or reference files.\n- [COMMAND_EXECUTION]: The skill provides ripgrep (
rg) command patterns for the agent to perform localized static analysis on plugin files. These commands are restricted to read-only patterns and do not involve executing untrusted input or remote scripts.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted plugin code for review. While this presents an attack surface for indirect prompt injection, the risk is managed by the agent's specific auditing instructions and the platform's underlying safety measures. \n - Ingestion points: The agent reads and analyzes user-provided PHP files within the plugin directory.\n
- Boundary markers: The skill relies on the agent's role as an auditor to distinguish between user data and instructions.\n
- Capability inventory: Capabilities are limited to reading local files and executing static analysis commands.\n
- Sanitization: The skill focuses on structural audit rather than direct code execution of the ingested data.
Audit Metadata