wp-api-fetch-client
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents methods for ingesting untrusted browser-side data and transmitting it to external REST endpoints, which constitutes a potential injection surface if response data is later processed by an agent without proper boundaries.
- Ingestion points: The code examples in
SKILL.mddemonstrate capturing user input from browser form elements (e.g.,form.elements.title.value) to be sent as request data. - Boundary markers: The skill encourages the use of configured WordPress middleware for nonces and REST-relative paths to maintain request integrity.
- Capability inventory: The skill uses
wp.apiFetchand@wordpress/api-fetchto perform network operations against WordPress REST API routes. - Sanitization: The documentation explicitly instructs developers to avoid using
innerHTMLfor displaying responses and highlights the necessity of server-side validation and sanitization as the primary trust boundary.
Audit Metadata