wp-playground

Pass

Audited by Gen Agent Trust Hub on Jul 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions utilize npx to fetch and execute the @wp-playground/cli tool and install Playwright for end-to-end testing. It also supports fetching 'Blueprints' (configuration recipes) and assets from official WordPress domains. These operations use well-known tools and trusted infrastructure.
  • [COMMAND_EXECUTION]: The skill utilizes several CLI commands for local WordPress server orchestration, PHPUnit testing, and E2E testing. All commands are aligned with the intended functionality of managing isolated WordPress environments.
  • [DATA_EXFILTRATION]: No evidence of exfiltration was found. Mentions of file mounting (--auto-mount, --mount) are standard features for mapping local development files into the virtual environment for testing purposes.
  • [DYNAMIC_EXECUTION]: The skill describes the use of 'Blueprints' which may contain a runPHP step. This allows for the execution of arbitrary PHP code within the isolated WebAssembly environment for automation. While this provides a wide range of capabilities, it is a documented and core feature of the official tool for its intended development use case.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 2, 2026, 07:26 PM