wp-project-triage

Warn

Audited by Runlayer on Feb 22, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
78%
Files
3
Flagged
3
Chunks
4
Flagged Files (3)
SKILL.mdHIGH
78.3%

Malicious tool definition detected

Tool: SKILL.md Description: --- name: wp-project-triage description: "Use when you need a deterministic inspection of a WordPress repository (plugin/theme/block theme/WP core/Gutenberg/full site) including tooling/tests/version hints, and a structured JSON report to guide workflows and guardrails." compatibility: "Targets WordPress 6.9+ (PHP 7.2.24+).

references/triage.schema.jsonHIGH
78.3%

Malicious tool definition detected

Tool: references/triage.schema.json Description: { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://agentskills.local/wp-project-triage/triage.schema.json", "title": "WP Project Triage Report", "type": "object", "required": ["tool", "project", "signals", "tooling"], "properties": { "tool": { "type": "object", "required": ["name", "version"], "properties": { "name": { "type": "string", "const": "detect_wp_project" }, "version": { "type": "string" } }, "additionalProperti

scripts/detect_wp_project.mjsHIGH
78.3%

Malicious tool definition detected

Tool: scripts/detect_wp_project.mjs [1/2] Description: import fs from "node:fs"; import path from "node:path"; import process from "node:process"; const TOOL_VERSION = "0.1.0"; const DEFAULT_IGNORES = new Set([ ".git", "node_modules", "vendor", "dist", "build", "coverage", ".next", ".turbo", ]); function statSafe(p) { try { return fs.statSync(p); } catch { return null; } } function readFileSafe(p, maxBytes = 256 * 1024) { try { const buf = fs.readFileSync(p); if (buf.byteLength > maxBytes) retur

Tool: scripts/detect_wp_project.mjs [2/2] Description: usesWordpressScripts = Boolean( packageJson?.devDependencies?.["@wordpress/scripts"] || packageJson?.dependencies?.["@wordpress/scripts"] || packageJson?.scripts?.build?.includes("wp-scripts") || packageJson?.scripts?.start?.includes("wp-scripts") || packageJson?.scripts?.test?.includes("wp-scripts") || packageJson?.scripts?.lint?.includes("wp-scripts") ); const pkgHasInteractivity = Boolean( packageJson?.devDependencies?.["@wordpress/intera

Audit Metadata
Max File Score
78%
Classification
UNKNOWN_SERVER
Files Scanned
3
Files Flagged
3
Chunks Analyzed
4
Analyzed
Feb 22, 2026, 07:51 AM
Security Audit — runlayer — wp-project-triage