wp-block-markup
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill details the syntax for WordPress block markup, which relies on structured HTML comments and raw HTML tags. This creates a surface for indirect prompt injection where an agent might be manipulated into wrapping malicious content, such as XSS payloads or scripts, within these block structures. • Ingestion points: Data fields within blocks like wp:paragraph or wp:html in the SKILL.md file. • Boundary markers: The skill does not provide specific instructions for isolating or delimiting untrusted content. • Capability inventory: The skill is a documentation resource and does not include any executable scripts or tools for file system or network access. • Sanitization: No sanitization or validation logic is specified in the provided markup templates.
- [EXTERNAL_DOWNLOADS]: The skill contains references to official WordPress organization source code and developer documentation hosted on GitHub. These links target a well-known open-source project and are used as informational references.
Audit Metadata