superpowers-sage:wp-security

Name: superpowers-sage:wp-security
Availability: InStock
Author: codigodoleo

Apply WordPress security hardening patterns to Sage/Acorn projects.

13|Updated Mar 19, 2026

Search Tags:#security #sanitization #wordpress #capability #nonce #sage-acorn #sql-prep

Ready to run

npx skills add https://github.com/codigodoleo/superpowers-sage --skill superpowers-sage-wp-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: superpowers-sage:wp-security
Source: https://github.com/codigodoleo/superpowers-sage/tree/main/skills/wp-security
Command: npx skills add https://github.com/codigodoleo/superpowers-sage --skill superpowers-sage-wp-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

WordPress security hardening — nonce verification, wp_nonce_field, check_admin_referer, sanitize_text_field, sanitize_email, esc_html, esc_attr, esc_url, wp_kses, SQL injection prevention, $wpdb->prepare(), capability checks, current_user_can, authentication hardening, wp-config.php secrets, security headers, file permissions, Bedrock .env secrets, disable XML-RPC, brute force wp-login.php, CSRF protection

Core Features & Use Cases

Patterns for input sanitization, output escaping, nonce verification, capabilities, and safe DB interactions in Sage/Acorn projects.
Acts as a final review pass by the sage-router ensuring code security before deployment.
Suitable for REST endpoints, forms, and service classes across WordPress/Sage workflows.

Quick Start

Review inputs and apply sanitization, escaping, nonce verification, and capability checks across your Sage/Acorn project.

Frequently Asked Questions about superpowers-sage:wp-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What's the best way to prevent SQL injection in WordPress when using $wpdb?▼

Yes, this security hardening approach applies to REST endpoints by enforcing capability checks, nonce verification, and proper input sanitization to authenticate and validate requests within your Sage/Acorn workflows.

Do I need nonces and capability checks for custom WordPress forms?▼

Nonces and capability checks are required for custom WordPress forms to provide CSRF protection and verify permissions. This pattern ensures current_user_can and wp_nonce_field validation are applied before processing input.

How do I manage wp-config.php secrets and environment variables in Bedrock?▼

Managing wp-config.php secrets in Bedrock involves storing sensitive data in .env environment variables rather than hardcoding them. This secret management approach keeps authentication keys and credentials secure.

What security escaping functions should I use for WordPress output rendering?▼

Security escaping for WordPress output rendering requires using esc_html, esc_attr, esc_url, and wp_kses functions. This ensures data is properly sanitized and escaped before rendering in Sage/Acorn templates.