skills/wpultimatesecurity/wordpress-security-skills/cron-background-job-security/Gen Agent Trust Hub
cron-background-job-security
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill addresses the vulnerability surface where background jobs ingest data from potentially untrusted sources (e.g., cron triggers and stored arguments).\n
- Ingestion points: Data stored in the WordPress
cronoption, which can be influenced by administrative or user-controlled actions (SKILL.md,references/secure-cron-job.php).\n - Boundary markers: Recommends establishing an authorization boundary by re-checking capabilities (e.g.,
user_can()) within the callback, mitigating the risk of executing privileged actions via public cron triggers.\n - Capability inventory: Includes examples of database interactions via
$wpdb->queryand application-level actions like user data exports (references/secure-cron-job.php).\n - Sanitization: Prescribes the use of standard WordPress sanitization functions such as
absint()andesc_url_raw(), and prepared SQL queries to prevent injection attacks.
Audit Metadata