wordpress-woocommerce-development
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes the implementation of AI-powered features such as customer service chatbots and product description generation which ingest untrusted data from customers or external sources.
- Ingestion points: The workflow involves processing customer messages in chat panels and using product attributes for description generation.
- Boundary markers: The guidance explicitly recommends using human-reviewable drafts and grounding AI responses in approved product attributes rather than allowing autonomous execution.
- Capability inventory: The provided code snippets include handlers for updating product inventory and processing order statuses, which are powerful state-changing operations.
- Sanitization: The instructions include robust security recommendations such as nonce verification, capability checks using
current_user_can, and strict input validation (e.g., usingabsintand integer checks) to prevent unauthorized use. - [EXTERNAL_DOWNLOADS]: Recommends downloading AI connector plugins from the official WordPress.org repository, which is a well-known and trusted service for WordPress extensions.
- [COMMAND_EXECUTION]: Provides implementation for state-changing operations including inventory stock updates and order status transitions, which are protected by appropriate authorization and validation logic.
Audit Metadata