skills/wpultimatesecurity/wordpress-security-skills/security-auditing-code-review/Gen Agent Trust Hub
security-auditing-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Bash script for security reconnaissance. Evidence:
SKILL.mdcontains the instruction to runbash scripts/scan-security-sinks.sh /path/to/plugin-or-theme. The script performs heuristic text searches using theripgreputility. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted third-party WordPress code, which serves as an attack surface for indirect prompt injection. 1. Ingestion points: Untrusted PHP, PHTML, and INC files are read and searched (SKILL.md). 2. Boundary markers: The methodology instructs the agent to verify code behavior independently and not trust comments (SKILL.md). 3. Capability inventory: The skill utilizes local shell commands (
grep,rg) and provides structured manual review processes (references/grep-patterns.md). 4. Sanitization: Safety protocols mandate testing in disposable environments using dummy data, isolating the agent from production effects (SKILL.md, references/full-audit-workflow.md).
Audit Metadata