wp-abilities-audit
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows security best practices by recommending that audit reports be stored outside the plugin's worktree to avoid polluting the version history.
- [PROMPT_INJECTION]: The skill processes untrusted WordPress plugin source code as its primary input to generate security audit documents. This creates a surface for indirect prompt injection where malicious code or comments within the audited plugin could attempt to influence the agent's reporting.
- Ingestion points: WordPress plugin PHP files via the user-provided checkout path.
- Boundary markers: No explicit markers are defined for untrusted code segments.
- Capability inventory: Local filesystem reads and shell command execution (grep, ls).
- Sanitization: Not applicable, as the skill extracts metadata for reporting rather than execution.
Audit Metadata