The Agent Skills Directory

[SAFE]: The skill's primary function is to provide boilerplate templates and development guidelines for WordPress block creation. It adheres to WordPress security standards by instructing the agent to use ABSPATH checks, function guards, and official escaping functions like esc_html_e(), esc_attr(), and wp_kses_post() in the generated code.
[EXTERNAL_DOWNLOADS]: The package.json template includes the @wordpress/scripts package as a development dependency. This is a standard, well-known utility provided by the WordPress community for managing the block build pipeline and is considered a safe and expected resource.
[COMMAND_EXECUTION]: The skill defines standard development commands (e.g., wp-scripts build, wp-scripts start, wp-scripts format) within the generated package.json. These are intended for local development workflows and represent the standard tooling for the WordPress ecosystem.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a code generator based on user requirements, which inherently involves processing untrusted data. This potential attack surface is appropriately addressed by the skill's instructions, which mandate that the generated code must use WordPress security functions to sanitize and escape all output and attributes.

creating-blocks