wp-project-triage
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local script
node skills/wp-project-triage/scripts/detect_wp_project.mjsto perform repository triage and identify project components. This is a deterministic diagnostic function. - [INDIRECT_PROMPT_INJECTION]: The skill processes repository files and structure, which constitutes an ingestion surface for potentially untrusted data.
- Ingestion points: Local repository files and directory structure (e.g.,
theme.json,block.json, build configurations) scanned by the triage script. - Boundary markers: The procedure directs the agent to a structured JSON output contract (
triage.schema.json) to guide its workflow. - Capability inventory: Command execution (Node.js script).
- Sanitization: The skill relies on a deterministic script to generate its report rather than direct LLM parsing of the file content.
Audit Metadata