Skills
Navigate
skills/lonsdale201/wp-agent-skills/wp-svg-icon-api/Gen Agent Trust Hub

wp-svg-icon-api

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill documents an interface for ingesting external data via the file_path parameter in wp_register_icon. This presents a surface for indirect prompt injection if an agent were to process raw SVG files. Ingestion points: file_path parameter documented in SKILL.md. Boundary markers: Explicit documentation of path validation requirements and lazy-loading error behavior. Capability inventory: File-based icon registration, rendering via wp_get_icon, and exposure through REST API routes. Sanitization: The skill highlights reliance on the WordPress Core SVG sanitizer element allowlist.
  • [METADATA_POISONING]: The skill metadata and body text reference a future WordPress version (7.1) and a 2026 update date. While not functionally malicious, this metadata is currently inaccurate for existing stable releases and could be misleading regarding platform capabilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 07:08 PM
Security Audit — agent-trust-hub — wp-svg-icon-api