wp-bump
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Uses git, npm, and composer commands to manage the release workflow.
- [DYNAMIC_EXECUTION]: Extracts script names from package.json and composer.json at runtime and executes them.
- [EXTERNAL_DOWNLOADS]: May download external packages via npm if project dependencies are missing.
- [INDIRECT_PROMPT_INJECTION]: Processes untrusted project metadata to drive command execution.
- Ingestion points: Reads package.json, composer.json, and PHP plugin headers in the repository root (Step 0, SKILL.md).
- Boundary markers: None present to distinguish data from instructions.
- Capability inventory: Arbitrary script execution via npm run and composer run (Steps 4 and 5, SKILL.md).
- Sanitization: No validation of script contents before execution.
Audit Metadata