wp-admin-media-frame
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill consists of technical documentation and code snippets for standard WordPress development. It does not contain any malicious instructions or hidden payloads.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies ingestion points for untrusted data from the Media Library (via attachment.toJSON() in SKILL.md). It provides boundary markers by using specific event listeners (select event) and includes a capability inventory of standard WordPress media functions (wp_enqueue_media, wp_get_attachment_image). It explicitly mandates sanitization via absint() and authorization via current_user_can('upload_files') to prevent injection or unauthorized access.
- [CREDENTIALS_UNSAFE]: No hardcoded secrets, API keys, or private configuration data were found in the skill or its metadata.
- [REMOTE_CODE_EXECUTION]: The skill uses official WordPress script enqueuing mechanisms and does not download or execute code from untrusted remote sources.
Audit Metadata