wp-performance
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates performance diagnostics by executing WP-CLI commands through a Node.js script
scripts/perf_inspect.mjsand provides instructions for running various profiling tools likewp doctorandwp profile. - The
perf_inspect.mjsscript usesspawnSyncwith argument arrays to executewp, which safely handles user-provided paths and URLs without shell injection risk. - The instructions cover routine development tasks such as query optimization, cache management, and cron event handling.
- [EXTERNAL_DOWNLOADS]: The documentation suggests the installation of official WP-CLI packages to extend diagnostic capabilities.
- Recommended packages include
wp-cli/doctor-commandandwp-cli/profile-command, which are maintained by the official WordPress CLI team. - References point to official WordPress documentation and community resources at
wordpress.organdwp-cli.dev. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local system diagnostics and command outputs to provide performance reports.
- Ingestion points: Standard output from
wpCLI commands and file system metadata collected byperf_inspect.mjs(SKILL.md, perf_inspect.mjs). - Boundary markers: The
perf_inspect.mjsscript outputs structured JSON to separate diagnostic data from instructions. - Capability inventory: The skill uses
spawnSyncfor system commands andfs.statSyncfor file existence checks (perf_inspect.mjs). - Sanitization: Content is processed as technical diagnostic data within a developer-controlled environment.
Audit Metadata