wordpress-woocommerce-development
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill documentation includes examples for processing untrusted data (user questions and order details) through AI prompts, creating a potential indirect prompt injection surface. However, this is inherent to the skill's primary purpose of demonstrating AI integration. The implementation includes standard security measures like nonce verification and role-based access control.
- Ingestion points: Functions
handle_ai_product_questionandai_validate_orderinSKILL.mdingest user-supplied text. - Boundary markers: The prompts interpolated with variables lack explicit delimiters to isolate untrusted data.
- Capability inventory: The skill defines high-privilege actions like
woocommerce/update-inventoryandwoocommerce/process-orderinSKILL.md. - Sanitization: The code correctly utilizes standard WordPress sanitization functions (e.g.,
sanitize_text_field,absint,sanitize_email), which effectively mitigate common web vulnerabilities like XSS.
Audit Metadata