The Agent Skills Directory

[SAFE]: The skill provides high-quality security guidance for WordPress development. It correctly identifies SSRF risks when using outbound HTTP APIs and provides robust mitigation strategies.
[SAFE]: The implementation in references/secure-http-request.php follows best practices by using esc_url_raw() for sanitization, implementing an explicit host allowlist, and utilizing wp_http_validate_url() to block private/loopback IP ranges.
[SAFE]: The skill emphasizes the use of wp_safe_remote_get() and wp_safe_remote_post(), which are the recommended WordPress functions for handling untrusted URLs, as they automatically validate redirect targets.
[SAFE]: Proper authorization and authentication checks are demonstrated in the example form handler (my_plugin_handle_webhook_form), including nonce verification via check_admin_referer() and capability checks via current_user_can().
[SAFE]: The documentation explicitly warns against common anti-patterns such as ignoring is_wp_error() or outputting unescaped response bodies, which helps prevent secondary vulnerabilities like XSS.

http-api-ssrf-prevention