Skills
Navigate
skills/lonsdale201/wp-agent-skills/wp-admin-drag-and-drop/Gen Agent Trust Hub

wp-admin-drag-and-drop

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill exclusively utilizes WordPress core script handles such as jquery-ui-sortable, jquery-ui-draggable, and wp-api-fetch. These are internal platform assets and do not involve external remote code execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data through DOM attributes.
  • Ingestion points: data-rule-id, data-card-id, and data-item-id in SKILL.md and reference.md.
  • Boundary markers: Not applicable for DOM attribute extraction.
  • Capability inventory: Persistence of data via wp-api-fetch POST and DELETE requests.
  • Sanitization: The skill mandates the use of permission_callback for authorization and validate_callback with wp_parse_id_list for input sanitization in the REST endpoint example.
  • [SAFE]: All network operations are directed to local WordPress REST API routes using the standard wp-api-fetch utility, which includes nonce-based authentication. No data exfiltration to external domains or hardcoded credentials were found.
  • [SAFE]: The skill emphasizes accessibility by integrating wp.a11y.speak() for screen reader announcements and providing keyboard-accessible alternatives to drag-and-drop interactions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 07:08 PM
Security Audit — agent-trust-hub — wp-admin-drag-and-drop