wp-ai-client
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive security guidance for WordPress AI integrations, explicitly instructing developers to sanitize all user-provided data using standard WordPress functions like
sanitize_textarea_fieldandwp_unslashbefore including them in AI prompts. - [SAFE]: It emphasizes the importance of treating AI-generated content as untrusted input, requiring validation and escaping before storage or rendering.
- [SAFE]: The documentation includes strict rules for tool usage (WordPress Abilities), recommending a granular allowlist approach via
WP_AI_Client_Ability_Function_Resolverto prevent unauthorized function execution by models. - [SAFE]: Credential security is addressed by forbidding hard-coded API keys and directing developers to use official WordPress Connectors or environment variables.
- [EXTERNAL_DOWNLOADS]: The skill references technical documentation and field guides from
make.wordpress.org. These are official, well-known, and trusted resources for WordPress core development and do not represent a security risk.
Audit Metadata