The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches agent skills from the official WordPress GitHub organization using npx skills add. These resources provide the agent with specialized capabilities for WordPress plugin and block development.
[EXTERNAL_DOWNLOADS]: Downloads coding and security instructions from a public repository (github/awesome-copilot) to local project storage at .github/instructions/. These files help ensure that the agent follows WordPress-specific best practices.
[COMMAND_EXECUTION]: Automates project setup using shell commands like npm init, git init, and composer require. Command execution in scripts/plan_setup.mjs is handled with hardcoded templates to mitigate the risk of shell injection from user-provided metadata.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by importing an external markdown instruction file into the project context.
Ingestion points: The wordpress.instructions.md file is downloaded via curl in SKILL.md (Phase 6b) and scripts/plan_setup.mjs.
Boundary markers: None; the downloaded content is integrated directly as a set of rules for the AI agent to follow.
Capability inventory: The agent possesses capabilities to execute shell commands (npm, git, composer), perform file system operations, and manage dependencies within the repository.
Sanitization: The skill does not sanitize the contents of the downloaded instruction file before placing it in the project directory.

wp-prepare