The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions and documentation recommend the use of official WordPress development tools such as @wordpress/scripts and @wordpress/create-block. These are well-known, trusted utilities for building and scaffolding blocks within the WordPress ecosystem.
[DATA_EXFILTRATION]: The included script scripts/list_blocks.mjs performs a local filesystem scan to identify WordPress blocks by locating block.json files. It extracts metadata for the agent's use within the local environment and does not include functionality to access sensitive system paths or transmit data to external servers.
[PROMPT_INJECTION]: The skill processes block.json files from local projects, which represents a surface for indirect prompt injection. However, the risk is inherent to the skill's primary purpose and the implementation is limited to extracting specific metadata fields.
Ingestion points: scripts/list_blocks.mjs reads block.json files from the local project root.
Boundary markers: No explicit delimiters are used in the script's JSON output to the agent.
Capability inventory: The agent is authorized to use bash and node for common development tasks (build, lint, test).
Sanitization: The script extracts structured keys and limits the number of attributes processed to mitigate potential resource exhaustion or injection attempts.

wp-block-development