The Agent Skills Directory

[SAFE]: The skill implements standard WordPress security best practices across all provided templates.
[COMMAND_EXECUTION]: No dangerous command execution or subprocess calls are present. The PHP code follows standard plugin structures.
[CREDENTIALS_UNSAFE]: While an 'API Key' field is defined in the settings class, it is used as a template for user input rather than hardcoding secrets. It correctly uses 'password' type for masking and sanitizes input with sanitize_text_field.
[DATA_EXFILTRATION]: No unexpected network operations or data exfiltration patterns were detected. AJAX and REST API endpoints are properly scoped to the WordPress environment.
[PROMPT_INJECTION]: The skill instructions do not contain attempts to override agent behavior or safety filters.
[OBFUSCATION]: The code is clear and does not contain hidden or encoded malicious content.
[PRIVILEGE_ESCALATION]: Capability checks using current_user_can('manage_options') and current_user_can('edit_posts') are correctly implemented to ensure only authorized users can perform sensitive actions.
[INDIRECT_PROMPT_INJECTION]: The REST API and AJAX handlers include sanitization (sanitize_text_field, wp_kses_post) and validation, minimizing the surface for indirect injection via processed data.
[DYNAMIC_EXECUTION]: The use of require_once for autoloader and internal files is standard and uses constant-based paths (PLUGIN_NAME_PATH), which is safe practice.

wp-plugin