wp-plugin-development
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill triggers the execution of local utility scripts using Node.js to perform project triage and plugin detection. Evidence includes calls to
node skills/wp-project-triage/scripts/detect_wp_project.mjsandnode skills/wp-plugin-development/scripts/detect_plugins.mjsin Step 0. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes content from third-party WordPress plugin files, which could lead to instructions being parsed from code comments or plugin headers. Ingestion points: WordPress plugin entrypoints and header files located in plugin directories (Step 0). Boundary markers: The instructions do not define specific delimiters or guardrails for the data processed by the detection scripts. Capability inventory: Use of Node.js scripts to scan and detect plugin headers. Sanitization: The procedure does not specify validation or sanitization of the detected plugin metadata before use in the agent's context.
Audit Metadata