The Agent Skills Directory

[SAFE]: The skill serves as an educational resource for WordPress security, specifically addressing the secure handling of shortcodes and dynamic blocks.
[SAFE]: Instructions correctly emphasize that shortcode_atts() does not sanitize input and provide guidance on using appropriate WordPress sanitization functions like sanitize_text_field() and esc_url_raw().
[SAFE]: Provided code examples in references/secure-shortcode-block.php demonstrate secure implementation patterns, including allowlisting attributes, sanitizing inputs, and context-aware output escaping using esc_html(), esc_attr(), and wp_kses_post().
[SAFE]: No malicious patterns, such as prompt injection, data exfiltration, obfuscation, or unauthorized command execution, were found in the skill or its references.

shortcode-block-security