Skills
Navigate
skills/lonsdale201/wp-agent-skills/wc-checkout-block-payment-method/Gen Agent Trust Hub

wc-checkout-block-payment-method

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [SAFE]: The skill provides defensive security guidance for developers, advising against the exposure of secret keys, webhook secrets, and cardholder data (PAN/CVV) in client-side settings or logs.\n- [INDIRECT_PROMPT_INJECTION]: The skill describes a system that processes external payment data from the WooCommerce Store API.\n
  • Ingestion points: Untrusted data enters the agent context via the payment_data parameter in SKILL.md and references/blocks-payment-lifecycle.md.\n
  • Boundary markers (present): Instructions describe the use of sanitize_key() and wc_clean() filters by the host platform.\n
  • Capability inventory: The code examples include database access via get_option and script registration via wp_register_script in SKILL.md.\n
  • Sanitization (present): The skill mandates server-side validation of data size, schema, and types for all external inputs.\n- [DYNAMIC_EXECUTION]: The PHP adapter implementation uses require to load a local build asset file (checkout.asset.php). This is a standard and safe WordPress development pattern for managing script metadata and does not involve the execution of untrusted or remote code.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 07:07 PM
Security Audit — agent-trust-hub — wc-checkout-block-payment-method