wp-performance

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local utility script skills/wp-performance/scripts/perf_inspect.mjs using Node.js and various WP-CLI commands such as wp profile and wp doctor to inspect the WordPress environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes output from external command executions and API responses which could potentially contain malicious instructions if the environment or the WordPress database were compromised.
  • Ingestion points: The skill reads output from wp doctor check, wp profile stage/hook, and x-qm-* REST API headers into the agent's context.
  • Boundary markers: No explicit delimiters are used to wrap the tool output in the prompt.
  • Capability inventory: The skill possesses the ability to execute shell commands and Node.js scripts.
  • Sanitization: There is no evidence of sanitization or filtering applied to the diagnostic data before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 10:43 AM