Your plugin talks to an LLM. We check what it says — and what it lets the model do.
Thousands of plugins are shipping AI features right now, written by developers who never had to think about prompt injection or tool permissions. This is the audit for the code everyone wrote this year.
What we check
Prompt-injection sinks
User-controlled input ($_GET, $_POST) concatenated into LLM prompts near a provider call. Adversaries can override your system prompt, exfiltrate context, or drive unintended tool calls and spend.
Keys leaked to the browser
wp_localize_script or inline JS carrying provider API keys. LLM keys are full-spend credentials — anyone can extract them from page source and run up unlimited bills.
Unbounded calls (cost bombs)
Provider requests with no max_tokens cap and no rate limiting. One crafted input can force maximum-length generations on every request — a direct financial attack.
Output execution & tool overreach
Model output flowing into eval() or unserialize(), and tool definitions granting shell access or unrestricted file writes to the model. Prompt injection becomes remote code execution.
Why now
Plugin security used to mean SQL injection and XSS. In 2026 it also means: what can a stranger make your plugin's LLM do, say, or spend? No other WordPress audit covers the agent layer — we built it first, and we run it on every audit.
- Deterministic rules — every check is verifiable, not an AI opinion
- Covers Anthropic, OpenAI, DeepSeek, Moonshot, and Google provider patterns
- File:line evidence with remediation guidance per finding
- Included in every audit at every tier — including free