wc-customer-and-sessions
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical guide for WooCommerce developers, focusing on the architectural distinction between session-based customer data (for checkout flow) and persistent account profiles (for registered users).
- [INDIRECT_PROMPT_INJECTION]: The skill describes handling user-controlled data from sources such as
$_POSTparameters and session storage. It mitigates injection risks by explicitly instructing developers to treat session values as untrusted input and providing examples of sanitization usingabsint(). It further mandates the validation of nonces, capabilities, and ownership at every write endpoint. - [CREDENTIALS_UNSAFE]: The skill includes explicit security warnings against storing sensitive information, including payment card data (PAN/CVV), passwords, API secrets, or bearer tokens within session data.
- [EXTERNAL_DOWNLOADS]: The skill references official WooCommerce documentation and internal plugin source paths for technical context. These references are informative and point to well-known, trusted project resources.
Audit Metadata