wp-plugin-development
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The
detect_plugins.mjsscript scans local PHP files to extract plugin headers, creating a surface where repository content could theoretically influence the agent's behavior via indirect prompt injection. - Ingestion points: Reads
.phpfiles from the repository viascripts/detect_plugins.mjs. - Boundary markers: No specific delimiters are used to wrap the parsed header content returned to the agent.
- Capability inventory: The skill is primarily instructional and provides file-system detection; it does not feature autonomous network exfiltration or unrestricted shell execution capabilities that could be triggered by parsed content.
- Sanitization: Headers are parsed using regular expressions and returned as raw strings without further sanitization.
Audit Metadata