Trust Assessment
wp-plugin-development received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Broad file system read access and disclosure of repository file paths, Potential data exfiltration via plugin header content.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on June 1, 2026 (commit 9b1e542c). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Broad file system read access and disclosure of repository file paths The `detect_plugins.mjs` script recursively reads all `.php` files within the agent's current working directory (`repoRoot`) up to a depth of 10 and a maximum of 5000 files. It then outputs the relative paths of these files (`pluginFile`) in its JSON report. This grants the skill broad read access to the repository's file system and discloses its internal structure, which could be sensitive information about the project layout. Restrict the scope of file system access to only necessary directories (e.g., `wp-content/plugins`, `wp-content/mu-plugins`) if possible, or implement stricter allow-listing for file types and paths. Ensure that the output of file paths is strictly necessary and sanitized if exposed to external users. | Static | scripts/detect_plugins.mjs:79 | |
| MEDIUM | Potential data exfiltration via plugin header content The `detect_plugins.mjs` script reads and extracts various fields from WordPress plugin headers (e.g., `Plugin Name`, `Description`, `Author URI`). While these are typically metadata, developers sometimes include sensitive information (e.g., internal URLs, specific build details, or even accidental credentials) within these header comments. The script outputs these extracted headers in its JSON report, which could lead to the exfiltration of such sensitive data if present. Implement sanitization or redaction for potentially sensitive fields within plugin headers before outputting them. Consider if all header fields are strictly necessary for the skill's operation or if a subset would suffice. Advise users not to store sensitive information in plugin headers. | Static | scripts/detect_plugins.mjs:56 |
Scan History
Embed Code
[](https://skillshield.io/report/ba7a47e9c9b29fdc)
Powered by SkillShield