wp-admin-codemirror
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses official WordPress APIs (
wp_enqueue_code_editor,wp_enqueue_script,wp_add_inline_script) to implement functionality. No malicious behaviors such as credential exfiltration, remote code execution, or unauthorized network activity were detected. - [INDIRECT_PROMPT_INJECTION]: The skill describes an interface for editing code, which by nature processes untrusted input. However, it incorporates standard security measures to mitigate risks.
- Ingestion points: Untrusted data is processed via the
<textarea>field defined in the view logic inSKILL.md. - Boundary markers: No specific delimiters or "ignore" instructions are implemented for the editor content itself.
- Capability inventory: The skill utilizes PHP
admin_enqueue_scriptsandwp_code_editor_settingshooks, along with client-side JavaScript initialization. - Sanitization: The provided PHP snippet correctly utilizes
esc_textarea()to sanitize content before rendering it into the editor, which is a key security best practice in WordPress.
Audit Metadata