OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill facilitates WordPress plugin development by reading external repository code and executing local scripts. Due to the combination of untrusted data ingestion (plugin source code) and high-privilege capabilities (file writing, bash/node execution, and WP-CLI), it presents a significant Indirect Prompt Injection surface.
Detected behaviors
No alerts
No issues
6/8 files flagged
Score: 93/100 · 2 sections analyzed