rest-api-security
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides high-quality defensive programming guidance specifically for the WordPress REST API surface. It explicitly warns against common vulnerabilities such as broken access control (e.g., advising against
__return_truefor write operations) and cross-site scripting (XSS) in API responses. - [SAFE]: The provided code examples in
references/secure-rest-endpoint.phpdemonstrate best practices, including versioned namespaces, strict capability checks withcurrent_user_can, and comprehensive input sanitization using standard WordPress functions likeabsintandsanitize_textarea_field. - [SAFE]: All external links point to official WordPress developer documentation (
developer.wordpress.org) and recognized security organizations like OWASP, which are trusted sources for security configuration and best practices.
Audit Metadata