The Agent Skills Directory

[SAFE]: The skill follows security best practices by explicitly instructing that API keys must be stored in environment variables rather than code. It also includes safeguards such as requiring backups before updates and restricting plugin installations to trusted sources.
[PROMPT_INJECTION]: The skill identifies as a CMS manager that processes external data from various sources (API endpoints, migration files in JSON/CSV/Markdown), creating a surface for indirect prompt injection.
Ingestion points: Processes content from Headless CMS APIs and migration files as described in the Migration and Headless CMS modes in SKILL.md.
Boundary markers: There are no specific instructions to the agent to use delimiters or ignore instructions found within the processed CMS data.
Capability inventory: The skill employs wp-cli for administrative actions including database migrations and plugin management.
Sanitization: Structural advice is provided to keep business logic out of templates and use trusted plugins, which provides some mitigation against malicious content execution.
[COMMAND_EXECUTION]: Includes legitimate administrative wp-cli commands used for WordPress core updates, plugin maintenance, and database management. These commands are restricted to the intended role of a CMS manager.

web-cms-manager