wp-block-bindings-api
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents an API designed to process dynamic data from block markup, which represents a potential injection surface.\n
- Ingestion points: The
argsparameter inget_value_callbackis sourced directly from block attributes in the post content (SKILL.md).\n - Boundary markers: The documentation explicitly warns that "args and block markup are attacker-controlled input" and provides a security checklist (SKILL.md).\n
- Capability inventory: Callbacks can access database records via
get_post_metaand other WordPress functions (SKILL.md).\n - Sanitization: The provided examples demonstrate sanitizing keys using
sanitize_key()and validating inputs against strict allowlists (SKILL.md).
Audit Metadata