The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: Evaluated the surface for processing external data:
Ingestion points: $_POST['my_plugin_api_key'] in references/secure-secret-storage.php.
Boundary markers: Implements check_admin_referer (CSRF protection) and current_user_can('manage_options') (authorization check) to ensure only authenticated administrators can trigger the logic.
Capability inventory: Limited to safe WordPress API operations (update_option, update_user_meta) and cryptographic operations; no subprocess calls, arbitrary file-system writes, or network operations are present.
Sanitization: Data is properly sanitized using sanitize_text_field and wp_unslash before storage.
[SAFE]: The skill correctly demonstrates security best practices, such as avoiding hardcoded secrets, using salted hashes for password verification, and employing authenticated encryption for secrets stored at rest. All provided code examples prioritize secure defaults and include necessary security headers and capability checks.

secrets-credentials-management