wordpress-block-theming
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill generates WordPress theme code based on user specifications, which creates a potential surface for malicious instructions to be processed by the agent.\n
- Ingestion points: User-provided theme requirements and design goals.\n
- Boundary markers: None explicitly defined to isolate user instructions from the generation process.\n
- Capability inventory: Generates PHP and JavaScript files, and injects scripts into the site footer.\n
- Sanitization: The skill provides comprehensive guidance on using WordPress escaping functions (esc_html, esc_attr, esc_url) and explicitly bans dangerous PHP functions like eval() and exec().\n- [EXTERNAL_DOWNLOADS]: The skill enqueues typography resources from a well-known service.\n
- Evidence: Downloads Google Fonts from https://fonts.googleapis.com.\n- [DYNAMIC_EXECUTION]: The skill provides templates for generating browser-side scripts and server-side definitions.\n
- Evidence: Includes a JavaScript snippet for scroll-triggered animations to be outputted via wp_add_inline_script or the wp_footer hook.\n
- Evidence: Provides PHP templates for enqueuing assets and registering block patterns in functions.php.
Audit Metadata