wp-bootstrap
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on a suite of shell and Node.js scripts (
bootstrap.sh,detect-structure.mjs,setup-github.sh,pull-wpe-env.sh) to automate project initialization. These scripts perform routine development tasks such as configuring Git hooks, managing directory structures, and interacting with the GitHub CLI to manage repository settings and branch protection. - [EXTERNAL_DOWNLOADS]: Fetches development tools and dependencies from well-known and trusted sources. This includes the WordPress Playground CLI, various linting and testing packages from the npm registry, and PHP packages from WPackagist (the official WordPress mirror for Composer).
- [REMOTE_CODE_EXECUTION]: Utilizes
pnpm dlxwithinplayground-start.shandplayground-verify.shto download and run the@wp-playground/clitool at runtime. This is an official tool from the WordPress project used for headless and interactive site verification. - [SAFE]: The skill includes robust secret management practices. The
setup-github.shscript provides interactive prompts for sensitive information like SSH keys and API passwords, specifically to store them as encrypted GitHub Secrets rather than plain-text files. It also utilizesssh-keyscanto securely verify the identities of remote hosts during setup.
Audit Metadata