skills.rest
codigodoleo
codigodoleoOFFICIAL
Explore all skills by this author →
GitHub

superpowers-sage:wp-security

Apply WordPress security hardening patterns to Sage/Acorn projects.

13|Updated Mar 19, 2026
Search Tags:#security#sanitization#wordpress#capability#nonce#sage-acorn#sql-prep
One-click install
npx skills add https://github.com/codigodoleo/superpowers-sage --skill superpowers-sage-wp-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: superpowers-sage:wp-security
Source: https://github.com/codigodoleo/superpowers-sage/tree/main/skills/wp-security
Command: npx skills add https://github.com/codigodoleo/superpowers-sage --skill superpowers-sage-wp-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

WordPress security hardening — nonce verification, wp_nonce_field, check_admin_referer, sanitize_text_field, sanitize_email, esc_html, esc_attr, esc_url, wp_kses, SQL injection prevention, $wpdb->prepare(), capability checks, current_user_can, authentication hardening, wp-config.php secrets, security headers, file permissions, Bedrock .env secrets, disable XML-RPC, brute force wp-login.php, CSRF protection

Core Features & Use Cases

  • Patterns for input sanitization, output escaping, nonce verification, capabilities, and safe DB interactions in Sage/Acorn projects.
  • Acts as a final review pass by the sage-router ensuring code security before deployment.
  • Suitable for REST endpoints, forms, and service classes across WordPress/Sage workflows.

Quick Start

Review inputs and apply sanitization, escaping, nonce verification, and capability checks across your Sage/Acorn project.

Frequently Asked Questions about superpowers-sage:wp-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What's the best way to prevent SQL injection in WordPress when using $wpdb?▼

Yes, this security hardening approach applies to REST endpoints by enforcing capability checks, nonce verification, and proper input sanitization to authenticate and validate requests within your Sage/Acorn workflows.

Do I need nonces and capability checks for custom WordPress forms?▼

Nonces and capability checks are required for custom WordPress forms to provide CSRF protection and verify permissions. This pattern ensures current_user_can and wp_nonce_field validation are applied before processing input.

How do I manage wp-config.php secrets and environment variables in Bedrock?▼

Managing wp-config.php secrets in Bedrock involves storing sensitive data in .env environment variables rather than hardcoding them. This secret management approach keeps authentication keys and credentials secure.

What security escaping functions should I use for WordPress output rendering?▼

Security escaping for WordPress output rendering requires using esc_html, esc_attr, esc_url, and wp_kses functions. This ensures data is properly sanitized and escaped before rendering in Sage/Acorn templates.

Related Skills

Explore More Software Engineering Skills→
hekivohekivo
13

superpowers-sage:wp-security

Enforce sanitization, escaping, and authorization rules in WordPress/Sage/Acorn code.

Official
Advanced
0xRayAI0xRayAI

security-scan

Scan software projects for security vulnerabilities and generate risk reports.

Official
Intermediate
hekivohekivo
13

superpowers-sage:acorn-middleware

Protect Acorn HTTP routes with JWT authentication and role checks.

Official
Advanced
codigodoleocodigodoleo
13

superpowers-sage:acorn-routes

Defines and manages Acorn routes in WordPress Sage projects.

Official
Advanced