wp-playground
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions utilize
npxto fetch and execute the@wp-playground/clitool and install Playwright for end-to-end testing. It also supports fetching 'Blueprints' (configuration recipes) and assets from official WordPress domains. These operations use well-known tools and trusted infrastructure. - [COMMAND_EXECUTION]: The skill utilizes several CLI commands for local WordPress server orchestration, PHPUnit testing, and E2E testing. All commands are aligned with the intended functionality of managing isolated WordPress environments.
- [DATA_EXFILTRATION]: No evidence of exfiltration was found. Mentions of file mounting (
--auto-mount,--mount) are standard features for mapping local development files into the virtual environment for testing purposes. - [DYNAMIC_EXECUTION]: The skill describes the use of 'Blueprints' which may contain a
runPHPstep. This allows for the execution of arbitrary PHP code within the isolated WebAssembly environment for automation. While this provides a wide range of capabilities, it is a documented and core feature of the official tool for its intended development use case.
Audit Metadata