The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides guidance on handling untrusted user input from login forms and redirect parameters.
Ingestion points: $_POST and $_REQUEST data handled in SKILL.md and references/secure-authentication.php.
Boundary markers: The skill explicitly recommends and demonstrates using check_admin_referer (nonces) and wp_validate_redirect to validate inputs.
Capability inventory: Uses wp_signon for authentication and wp_safe_redirect for navigation.
Sanitization: Provides clear instructions for using sanitize_user, wp_unslash, and esc_html to process external data.
[DATA_EXPOSURE_AND_EXFILTRATION]: No sensitive file access or unauthorized network operations were detected. The use of $_SERVER['REMOTE_ADDR'] is documented correctly for the purpose of security-related rate limiting (throttling).
[COMMAND_EXECUTION]: No shell command execution or unsafe subprocess spawning was found. The skill focuses entirely on standard WordPress PHP APIs.
[PROMPT_INJECTION]: No attempts to override agent behavior or bypass safety filters were detected. The instructional language is defensive and focused on improving application security.

authentication-session-security