wp-rocket-mcp-and-abilities
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate security guidance for WP Rocket's AI integration features. It correctly identifies that while the OAuth server is off by default, the underlying abilities are on by default and provides instructions to disable them using the rocket_enable_abilities filter.
- [INDIRECT_PROMPT_INJECTION]: The skill documents a surface for natural language interaction with plugin settings. 1. Ingestion points: option_value parameter in wp-rocket/set-option ability (SetOption.php). 2. Boundary markers: Access is restricted to users with the rocket_manage_options capability and further limited by the rocket_mcp_options_allowlist (AllowedOptions.php). 3. Capability inventory: Writing configuration options to the WordPress database. 4. Sanitization: The skill notes that values are sanitized per option type by the underlying plugin logic.
- [SAFE]: No signs of prompt injection, obfuscation, or malicious exfiltration were detected. The mention of Mixpanel telemetry is documented as a standard vendor feature for the purpose of transparency and compliance.
Audit Metadata