wp-playground
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the official
@wp-playground/clitool to manage WordPress instances. This tool is developed and maintained by the WordPress organization.- [INDIRECT_PROMPT_INJECTION]: The skill implements the--blueprintflag, which enables the tool to load configuration data from external URLs or local files. - Ingestion points: External blueprint URLs and local files are ingested via the
run-blueprintcommand inSKILL.md. - Boundary markers: The skill does not provide specific instructions to the agent to treat blueprint content as untrusted data or use delimiters.
- Capability inventory: The CLI tool can mount local directories, write snapshot files to the disk, and execute WordPress/PHP operations as defined within the blueprint.
- Sanitization: The instructions do not specify any validation or sanitization steps for the content of external blueprints before they are executed.
Audit Metadata