wp-project-triage
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted files from a repository to detect project structure and metadata.
- Ingestion points: The
scripts/detect_wp_project.mjsscript reads file contents (e.g.,.php,.js,.json,.css) from the target directory usingfs.readFileSyncto identify specific signatures and configuration constants. - Boundary markers: None; the script reads raw file contents into memory for analysis.
- Capability inventory: The skill is restricted to read-only filesystem access and standard output (stdout). It does not contain capabilities for writing files, executing external commands, or making network requests.
- Sanitization: Content extracted from files is processed using regular expressions and string matching, and then encapsulated in a structured JSON object for output.
Audit Metadata