The Agent Skills Directory

[SAFE]: This skill is primarily composed of educational material, examples, and reference guides for WordPress block development. It instructs the agent on proper coding standards and security practices without including any malicious logic or exfiltration mechanisms.
[COMMAND_EXECUTION]: The skill suggests several shell command patterns using rg (ripgrep) and grep for the agent to use during its analysis. These are used for local static analysis to find specific code strings in files like block.json and React source files, which is a common and appropriate use of tools for a code auditing skill.
[INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection as its primary function is to ingest and analyze untrusted code files provided by a user.
Ingestion points: Reads local project files including PHP, JavaScript, and JSON metadata documents.
Boundary markers: The instructions do not define delimiters or explicit boundary markers to wrap untrusted data during analysis to prevent context leakage.
Capability inventory: File system read access and shell command execution via search utilities.
Sanitization: No sanitization methodology is prescribed for handling untrusted text found in comments, strings, or metadata within the files being audited.

wp-block-development