The Agent Skills Directory

[SAFE]: The skill instructions prioritize security best practices for WordPress development, including mandatory requirements for output escaping (e.g., esc_html, esc_attr) and input sanitization (e.g., sanitize_text_field, absint).
[SAFE]: It provides strong directives against SQL injection by mandating the use of $wpdb->prepare or official WordPress APIs for database operations.
[SAFE]: The skill enforces proper authorization and CSRF protection by requiring both capability checks (current_user_can) and nonce verification for all state-changing requests and REST API routes.
[SAFE]: Explicit instructions are included to prevent the exposure of sensitive information, such as forbidding the invention or commitment of database credentials, salts, or Application Passwords.
[SAFE]: Development practices promoted include production hardening (e.g., DISALLOW_FILE_EDIT) and the safe use of WP-CLI (requiring --dry-run before applying changes).

wordpress