elementor-v3-widget-development
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate development guidelines for WordPress Elementor widgets, focusing on the classic V3 API.
- [SAFE]: The provided code examples follow industry security best practices, specifically instructing on input validation using
Utils::validate_html_tagand output escaping using standard WordPress functions likeesc_html,esc_attr, andwp_kses_post. - [SAFE]: No suspicious external network requests, obfuscated code, persistence mechanisms, or unauthorized file access patterns were identified within the skill instructions or reference files.
- [INDIRECT_PROMPT_INJECTION]: The skill addresses potential injection surfaces where untrusted data enters the agent context.
- Ingestion points: Untrusted user data enters through the
$this->get_settings_for_display()method in the widget class (documented inreferences/widget-contract-and-example.md). - Boundary markers: The skill instructs developers to separate display logic from data and use explicit HTML tags to bound output.
- Capability inventory: The code examples include file inclusion (
require_once) and script/style registration (wp_register_script,wp_register_style). - Sanitization: The skill explicitly mandates the use of
esc_html(),esc_attr(), andwp_kses_post()for all output rendering, effectively mitigating the risk of injection from processed data.
Audit Metadata