The Agent Skills Directory

[SAFE]: The skill serves as a technical knowledge base for Craft CMS 5 plugin and module development, consisting entirely of markdown documentation and PHP/Twig code snippets.
[DATA_EXPOSURE]: The documentation provides explicit instructions on how to handle sensitive data securely.
It demonstrates the use of environment variables ($CRAFT_SECURITY_KEY, $CRAFT_DB_PASSWORD) to avoid hardcoding credentials in configuration files.
It guides developers to use the App::parseEnv() helper to resolve secrets at runtime, following industry standards for secret management.
[EXTERNAL_DOWNLOADS]: The skill references established and reputable third-party libraries within the Craft CMS ecosystem.
Documentation mentions packages such as nystudio107/craft-plugin-vite, craftcms/phpstan, and markhuot/craft-pest-core as standard tools for modern development workflows.
Examples for CI/CD pipelines use widely trusted GitHub Actions (e.g., actions/checkout, shivammathur/setup-php).
[INDIRECT_PROMPT_INJECTION]: The skill provides robust security patterns for the AI agent to follow when generating or reviewing code.
It includes warnings about TOCTOU (Time-of-Check to Time-of-Use) vulnerabilities and parameter tampering in controller actions.
It mandates authorization checks (e.g., requirePermission, canSave) on all mutating operations.

craftcms