wp-add-skills
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches content from the official WordPress GitHub organization (https://github.com/WordPress/agent-skills). These downloads are used to retrieve the skill source code and build assets.
- [REMOTE_CODE_EXECUTION]: Executes scripts downloaded from a remote source, specifically 'skillpack-build.mjs' and 'skillpack-install.mjs' using Node.js. This behavior is documented and requires explicit user confirmation before proceeding.
- [COMMAND_EXECUTION]: Utilizes system-level commands including 'git clone' for repository retrieval and 'node' for script execution. It also uses diagnostic commands like 'git --version', 'node --version', and 'df' to verify environment readiness.
Audit Metadata