The Agent Skills Directory

[SAFE]: The skill advocates for the use of explicit HTML escaping using htmlspecialchars with ENT_QUOTES | ENT_SUBSTITUTE for all dynamic output, which is a standard security best practice for preventing XSS.
[SAFE]: The guidance encourages the use of typed ViewModels (final readonly class), which helps minimize security risks associated with passing loose, untrusted associative arrays through different layers of an application.
[SAFE]: The skill warns against using raw PHP include calls, recommending the use of template engine abstractions (fetch) which provides better control over the rendering context.
[SAFE]: Localization and email rendering patterns use closed enums and application-controlled identifiers for template selection, preventing path traversal or file inclusion vulnerabilities from user-controlled strings.

php-templating