AI and LLM integration security

When to use this skill

Use this skill when WordPress code sends data to, or acts on output from, a language model:

• A chatbot, assistant, or "generate/summarize/translate" button in wp-admin or on the front end.
• AI search or retrieval-augmented generation (RAG) over posts, products, orders, or tickets.
• An agent that calls tools: plugin functions, REST routes, Abilities API abilities, or an MCP server that exposes site actions to external AI clients.
• Storing AI provider API keys, or exposing AI features to anonymous or low-role users.

Do not use it for ordinary outbound HTTP (use http-api-ssrf-prevention), generic secrets storage (use secrets-credentials-management), or REST routes with no model in the loop (use rest-api-security).

Core principles (and why they matter)