wp-playground

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to download and execute the @wp-playground/cli package from the official npm registry. This is a well-known tool maintained by the WordPress organization for creating localized development environments.
  • [COMMAND_EXECUTION]: Several examples are provided for executing shell commands using npx to start servers, run blueprints, and build snapshots. These commands are limited to the functionality of the WordPress Playground tool and are used for their intended purpose in a local or CI context.
  • [INDIRECT_PROMPT_INJECTION]: The skill features the ability to ingest external configuration data via the --blueprint flag, which can accept local files or remote URLs. This is a core feature of the WordPress Playground ecosystem.
  • Ingestion points: Blueprint files and URLs passed to the run-blueprint or server commands in SKILL.md.
  • Boundary markers: None explicitly defined in the skill instructions; it relies on the user or agent providing the path.
  • Capability inventory: Command execution of the Playground CLI, which manages a SQLite-backed WordPress instance and performs network operations to fetch assets.
  • Sanitization: Not explicitly documented in the skill; sanitization is handled by the underlying CLI tool which processes the JSON-based blueprints.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 10:43 AM