je-dynamic-visibility-condition
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements logic for processing external data (WordPress post, term, or user metadata) and user-defined settings to determine UI visibility. This represents a potential surface where maliciously crafted data could influence the agent's interpretation of visibility logic. However, the risk is mitigated by explicit instructions that visibility must not be used as a security boundary.
- Ingestion points:
Base::get_current_value(),$args['condition_settings'], and$args['value']documented inSKILL.mdandreferences/implementation-reference.md. - Boundary markers: Not explicitly defined for prompts; the logic is bounded by the PHP
check()method's boolean return requirement. - Capability inventory: The provided code templates are restricted to deterministic predicate logic and boolean checks. No dangerous operations such as file writing, arbitrary command execution, or network requests are included.
- Sanitization: The skill utilizes
adjust_values_type()for data coercion but relies on standard WordPress meta-handling for data retrieval.
Audit Metadata