wp-performance

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill automates performance diagnostics by executing WP-CLI commands through a Node.js script scripts/perf_inspect.mjs and provides instructions for running various profiling tools like wp doctor and wp profile.
  • The perf_inspect.mjs script uses spawnSync with argument arrays to execute wp, which safely handles user-provided paths and URLs without shell injection risk.
  • The instructions cover routine development tasks such as query optimization, cache management, and cron event handling.
  • [EXTERNAL_DOWNLOADS]: The documentation suggests the installation of official WP-CLI packages to extend diagnostic capabilities.
  • Recommended packages include wp-cli/doctor-command and wp-cli/profile-command, which are maintained by the official WordPress CLI team.
  • References point to official WordPress documentation and community resources at wordpress.org and wp-cli.dev.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local system diagnostics and command outputs to provide performance reports.
  • Ingestion points: Standard output from wp CLI commands and file system metadata collected by perf_inspect.mjs (SKILL.md, perf_inspect.mjs).
  • Boundary markers: The perf_inspect.mjs script outputs structured JSON to separate diagnostic data from instructions.
  • Capability inventory: The skill uses spawnSync for system commands and fs.statSync for file existence checks (perf_inspect.mjs).
  • Sanitization: Content is processed as technical diagnostic data within a developer-controlled environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 05:16 AM