woo-api
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch API reference material from official WooCommerce and WordPress documentation sites to inform its actions.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface by ingesting data from external documentation websites. This is a common pattern for documentation-heavy skills.
-
- Ingestion points: The skill fetches documentation from woocommerce.github.io and developer.wordpress.org as instructed in SKILL.md.
-
- Boundary markers: There are no explicit markers or instructions provided to separate the external content from the system prompt.
-
- Capability inventory: The skill is permitted to use tools such as Read, Write, Edit, and Bash which could be target of injection.
-
- Sanitization: No sanitization or validation logic is present for the data retrieved from the web.
Audit Metadata