wp-playground — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited wp-playground (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
npm/npx available.--auto-mount or explicit mount mapping).node -v) before running CLI.cd <plugin-or-theme-root>
npx @wp-playground/cli@latest server --auto-mount--wp=<version> / --php=<version> as needed.--skip-wordpress-setup and mount the whole tree.--mount=/host/path:/vfs/path (repeatable) when auto-mount is insufficient (multi-plugin, mu-plugins, custom content).--mount-before-install for bootstrapping installer flows.references/cli-commands.mdnpx @wp-playground/cli@latest run-blueprint --blueprint=<file-or-url>--blueprint-may-read-adjacent-files when required.references/blueprints.md for structure and common flags.npx @wp-playground/cli@latest build-snapshot --blueprint=<file> --outfile=./site.zip--xdebug (or --enable-xdebug depending on CLI release) to expose an IDE key, then connect VS Code/PhpStorm to the host/port shown in CLI output.--auto-mount for plugin/theme debugging.references/debugging.md--wp= to pin WP (e.g., 6.9.0) and --php= to test compatibility.https://playground.wordpress.net/#<base64-or-json-blueprint>https://playground.wordpress.net/?blueprint-url=<public-url-or-zip>--verbosity=debug to confirm steps executed.wp plugin list inside Playground shell via browser terminal if exposed) or UI click-path.--verbosity=debug.--blueprint-may-read-adjacent-files.--port=<free-port>.--experimental-multi-worker if enabled; or enable it to improve throughput on CPU-bound runs.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.