wp-plugin-lifecycle
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides standard documentation and code snippets for WordPress development. No malicious instructions, obfuscation, or unauthorized persistence mechanisms were identified.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface by instructing an agent to process and generate code for database operations and file management.
- Ingestion points: Analyzes plugin scaffolding and PR reviews as described in the 'When to use' section of
SKILL.md. - Boundary markers: None explicitly defined in the provided instructions.
- Capability inventory: Performs database writes and table drops (
dbDelta,$wpdb->query), manages site options (add_option,delete_option), handles WordPress cron schedules (wp_schedule_event,wp_unschedule_hook), and modifies user roles (add_cap,remove_cap). - Sanitization: Present; the reference patterns in
references/uninstall-and-multisite.mdexplicitly use$wpdb->prepare()and$wpdb->esc_like()to prevent SQL injection. - [DATA_EXFILTRATION]: The skill focuses on managing internal WordPress data (options, metadata, and custom tables). No network operations or commands that send data to external or non-whitelisted domains were detected.
Audit Metadata