wp-plugin-update-migrations
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill establishes best practices for WordPress plugin migrations, including idempotent steps, version tracking, and safe hook usage. It references official WordPress documentation and core files as context for development.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and review user-provided WordPress source code, which introduces an ingestion surface for untrusted data.
- Ingestion points: User-provided PHP code and architectural descriptions entered in the interaction context.
- Boundary markers: The skill does not define specific delimiters or warnings to ignore instructions embedded in the user-provided code.
- Capability inventory: The skill in SKILL.md describes the use of database modification functions (dbDelta, update_option) and task scheduling (wp-cron) within the context of the generated WordPress plugin logic.
- Sanitization: The skill does not provide instructions for sanitizing or validating user-provided code strings during the review process.
Audit Metadata