wc-downloadable-products
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents methods for processing product and customer data that may be derived from external sources. 1. Ingestion points: Product file URLs, download limits, and order metadata handled in
SKILL.mdandreferences/core-download-contract.md. 2. Boundary markers: The instructions highlight reliance on WooCommerce's standard$order->is_download_permitted()andset_downloads()validation mechanisms. 3. Capability inventory: The skill facilitates database and filesystem state changes via the WooCommerce API (Product and Customer Download CRUD). 4. Sanitization: Documentation explicitly warns against using untrusted request input for file paths and utilizes native WooCommerce validation checks to verify local file existence and approved directory membership. - [SAFE]: The skill serves as a legitimate technical guide for developers. It includes security audit checklists and identifies critical security requirements, such as protecting bearer links and using path allowlists for file delivery. The provided PHP snippets follow standard WooCommerce developer patterns without introducing malicious behavior or unsafe commands.
Audit Metadata