defensive-data-design
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill functions as a developer documentation guide for building robust and secure WordPress components. It covers best practices for user-facing error messages, confirmation patterns for permanent actions, and data integrity checks.
- [INDIRECT_PROMPT_INJECTION]: The instructions explicitly address the risk of untrusted data entering the system from external sources. It provides a structured approach to mitigating injection risks through validation and sanitization.
- Ingestion points: The skill identifies REST responses, block attributes, post meta, theme.json, filtered editor settings, and localStorage as untrusted boundaries (SKILL.md).
- Boundary markers: It recommends wrapping
JSON.parseintry/catchblocks and performing shape-checking (e.g.,Array.isArray) immediately at the entry boundary. - Capability inventory: The skill does not provide tools or scripts; it is an instructional guide for the agent's logic.
- Sanitization: It instructs the use of
@wordpress/dom's__unstableStripHTMLutility to sanitize error messages and other dynamic content. - [EXTERNAL_DOWNLOADS]: The skill references standard WordPress packages and internal documentation paths. It also links to official React documentation for error boundaries, which is a well-known and trusted source.
Audit Metadata