The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a scaffolding script (scripts/scaffold-plugin.sh) designed to automate the creation of new plugin projects. The script utilizes standard shell commands like cp, mv, and sed to set up directory structures and substitute template placeholders based on user input, with built-in validation to prevent path traversal.
[EXTERNAL_DOWNLOADS]: The documentation and examples reference well-known third-party libraries such as plugin-update-checker (by YahnisElsts) and git-updater (by afragen) for managing plugin updates via GitHub. These tools are standard in the WordPress development community for plugins hosted outside the official repository.
[REMOTE_CODE_EXECUTION]: Implementation patterns for automatic plugin updates from GitHub releases or tags are provided. These patterns enable remote code updates for the resulting plugins but are documented with security requirements like HTTPS and authentication tokens for private repositories.
[INDIRECT_PROMPT_INJECTION]: The provided templates ingest data from external request parameters (POST/GET/REST API). The skill correctly identifies this as a vulnerability surface and mitigates it by mandating the use of nonces for CSRF protection, capability checks for authorization, and strict sanitization (e.g., sanitize_text_field, absint) for all inputs.
[SAFE]: The skill functions as a security educational resource, providing production-ready patterns to prevent SQL injection (via $wpdb->prepare), Cross-Site Scripting (via context-aware escaping), and unauthorized access (via capability checks).

wordpress-plugin-core