lw-lms-wp-cli-operations
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official GitHub repository for the LW LMS plugin at
https://github.com/lwplugins/lw-lmsfor supplemental documentation. - [INDIRECT_PROMPT_INJECTION]: The skill outlines a surface for processing external data (such as titles, slugs, logins, and emails) through shell-based WP-CLI commands.
- Ingestion points: Command arguments for creating posts and resolving user/course entities in
SKILL.md. - Boundary markers: Commands use standard CLI flag syntax to delimit inputs.
- Capability inventory: Execution of specific, pre-defined WP-CLI commands (
wp lw-lms ...). - Sanitization: The documentation explicitly references the use of
CliResolverfor entity validation andsanitize_key()for key inputs, which mitigates injection risks. - [SAFE]: No malicious patterns, such as prompt injection, data exfiltration, or obfuscation, were identified. The instructions align with the stated purpose of managing a WordPress plugin via its command-line interface.
Audit Metadata