wp-file-upload-security
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides guidance on processing untrusted user data through various ingestion points and identifies the associated security surface.
- Ingestion points: The skill handles data from
$_FILESarrays, multipart form submissions, REST API endpoints, and remote file sideloading viadownload_url(found inSKILL.md). - Boundary markers: It promotes the use of WordPress nonces via
check_admin_refererand authorization checks usingcurrent_user_canto establish trust boundaries (found inSKILL.md). - Capability inventory: The skill utilizes powerful WordPress filesystem and media APIs, including
media_handle_upload,media_handle_sideload,unzip_file, andwp_delete_attachment(found inSKILL.md). - Sanitization: It mandates the use of
wp_check_filetype_and_extfor byte-level verification,sanitize_file_namefor filename safety, and explicit MIME allowlists to filter malicious content (found inSKILL.md).
Audit Metadata