wp-playground
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download and execute the
@wp-playground/clipackage from the official npm registry. This is a well-known tool maintained by the WordPress organization for creating localized development environments. - [COMMAND_EXECUTION]: Several examples are provided for executing shell commands using
npxto start servers, run blueprints, and build snapshots. These commands are limited to the functionality of the WordPress Playground tool and are used for their intended purpose in a local or CI context. - [INDIRECT_PROMPT_INJECTION]: The skill features the ability to ingest external configuration data via the
--blueprintflag, which can accept local files or remote URLs. This is a core feature of the WordPress Playground ecosystem. - Ingestion points: Blueprint files and URLs passed to the
run-blueprintorservercommands inSKILL.md. - Boundary markers: None explicitly defined in the skill instructions; it relies on the user or agent providing the path.
- Capability inventory: Command execution of the Playground CLI, which manages a SQLite-backed WordPress instance and performs network operations to fetch assets.
- Sanitization: Not explicitly documented in the skill; sanitization is handled by the underlying CLI tool which processes the JSON-based blueprints.
Audit Metadata