wp-presence-api
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a technical integration guide for a legitimate WordPress feature plugin. It aligns with standard development practices and includes necessary security warnings for experimental software.
- [EXTERNAL_DOWNLOADS]: The skill links to the official WordPress GitHub repository for the Presence API, which is a well-known and trusted source.
- [INDIRECT_PROMPT_INJECTION]: The skill documents the handling of external awareness data. 1) Ingestion points: Data enters via
wp_get_presenceand the/wp-presence/v1/presenceREST endpoint (SKILL.md). 2) Boundary markers: The API enforces a 10 KiB payload limit and a 3-level nesting limit to prevent resource exhaustion or complex injection (references/api-and-runtime.md). 3) Capability inventory: The API performs atomic database upserts but lacks subprocess, eval, or file-write capabilities across its documented functions (SKILL.md). 4) Sanitization: The documentation explicitly requires that data be escaped for its final output context, such as HTML, attributes, or JavaScript (references/api-and-runtime.md).
Audit Metadata