wp-bootstrap

Pass

Audited by Gen Agent Trust Hub on Jul 2, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on a suite of shell and Node.js scripts (bootstrap.sh, detect-structure.mjs, setup-github.sh, pull-wpe-env.sh) to automate project initialization. These scripts perform routine development tasks such as configuring Git hooks, managing directory structures, and interacting with the GitHub CLI to manage repository settings and branch protection.
  • [EXTERNAL_DOWNLOADS]: Fetches development tools and dependencies from well-known and trusted sources. This includes the WordPress Playground CLI, various linting and testing packages from the npm registry, and PHP packages from WPackagist (the official WordPress mirror for Composer).
  • [REMOTE_CODE_EXECUTION]: Utilizes pnpm dlx within playground-start.sh and playground-verify.sh to download and run the @wp-playground/cli tool at runtime. This is an official tool from the WordPress project used for headless and interactive site verification.
  • [SAFE]: The skill includes robust secret management practices. The setup-github.sh script provides interactive prompts for sensitive information like SSH keys and API passwords, specifically to store them as encrypted GitHub Secrets rather than plain-text files. It also utilizes ssh-keyscan to securely verify the identities of remote hosts during setup.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 2, 2026, 07:26 PM