wc-store-api
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The documentation identifies and describes an API surface that handles untrusted shopper-supplied JSON input.
- Ingestion points: The skill references endpoints such as
/wc/store/v1/cart/add-itemand/wc/store/v1/checkoutwhich accept external data payloads. - Boundary markers: The instructions specify the implementation of
Nonce(actionwc_store_api) andCart-Tokenheaders for session and origin validation. - Capability inventory: The documented interface allows the agent to perform cart mutations, order creation, and metadata updates in the WooCommerce database.
- Sanitization: The instructions explicitly promote the use of
wc_clean(),sanitize_text_field(), and custom validation/sanitization callbacks for all external fields.
Audit Metadata