The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides the agent with a series of shell commands using common utilities such as rg (ripgrep), sed, and grep to analyze the local WordPress theme directory. These tools are used to detect theme structure, validate theme.json versions, and identify anti-patterns like hardcoded inline styles.
[INDIRECT_PROMPT_INJECTION]: The skill's core purpose is to ingest and process external source code from WordPress themes (PHP, HTML, and JSON). This constitutes a potential surface for indirect prompt injection, as malicious instructions could theoretically be embedded in the files being reviewed. However, this risk is inherent to the primary purpose of a code auditing tool.
Ingestion points: The agent reads content from various files within the local WordPress theme structure, including functions.php, theme.json, and files in the templates/ and parts/ directories.
Boundary markers: The skill does not define specific delimiters or "ignore" instructions to wrap the code content during processing.
Capability inventory: The skill leverages read-only shell commands (rg, sed, grep, test) to inspect file contents and report findings.
Sanitization: There are no explicit sanitization or filtering mechanisms for the data extracted from the theme files before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill mentions external URLs, such as the official WordPress theme.json schema (schemas.wp.org) and Google Fonts (fonts.googleapis.com), within its documentation and analysis patterns. These references target well-known and trusted services for schema validation and best-practice checks.

wp-theme-development