wordpress-mcp-dev
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a documentation resource and development guide. It provides structured architectural patterns and code snippets for WordPress and MCP server development.
- [SAFE]: The guide includes a dedicated security checklist for WordPress development, mandating input sanitization (
sanitize_text_field), output escaping (esc_html), nonce verification for CSRF protection, and capability checks for authorization. - [SAFE]: It explicitly warns against dangerous coding practices, such as using
eval(),exec(), orsystem()with user input, and advises against direct SQL concatenation in favor of$wpdb->prepare(). - [SAFE]: For MCP server development, it outlines safety patterns like duplicate-first workflows (editing copies rather than live content) and content validation to prevent XSS or malformed HTML injections.
- [SAFE]: External links and dependencies refer to official documentation (WordPress.org, Model Context Protocol official site) or well-known development tools (NPM, Composer).
Audit Metadata