The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions and reference guides mention using standard development tools such as npx @wordpress/create-block for project scaffolding and phpcs --standard=WordPress for code style and security validation.
[EXTERNAL_DOWNLOADS]: The skill includes boilerplate code for a plugin update checker mechanism. This implementation demonstrates how to fetch plugin metadata from a remote JSON endpoint (e.g., https://example.com/api/plugin-updates/info.json) to determine if updates are available. This is a standard architectural pattern for self-hosted WordPress plugins.
[INDIRECT_PROMPT_INJECTION]: The skill defines patterns for building WordPress features that handle external user data (via $_POST, $_GET, and REST API endpoints). While this creates an attack surface, the skill specifically mandates the use of WordPress security functions to mitigate risks:
Ingestion points: Web form submissions and REST API request bodies analyzed in SKILL.md and references/performance-security.md.
Boundary markers: Instructions explicitly require manual verification of nonces and capability checks to isolate privileged actions.
Capability inventory: Scripts include database operations via $wpdb, file system access for backups, and network operations for update checks.
Sanitization: The skill enforces strict constraints requiring sanitization (sanitize_text_field, wp_kses_post) and escaping (esc_html, esc_url) for all I/O operations.

wordpress-pro