The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The framework documentation describes installing the core library and its template engine dependencies (Timber, Blade) via Composer. It also includes an automated feature for downloading JavaScript modules from the well-known esm.sh CDN to a local directory when using the npm: import syntax. These are documented architectural features of the framework.
[COMMAND_EXECUTION]: The documentation provides standard CLI instructions for framework bootstrapping and dependency management using Composer.
[COMMAND_EXECUTION]: The framework includes a populate feature that uses call_user_func_array to execute PHP functions (such as get_posts or custom functions) defined in the block.json configuration file. This is a primary feature of the framework used for dynamic data population in the WordPress editor.
[INDIRECT_PROMPT_INJECTION]: The skill processes structured configuration data from block.json, page.json, and blockstudio.json. It also provides a mechanism for fetching external data via URLs. To mitigate risks associated with untrusted data, the documentation explicitly instructs the assistant and developer to use WordPress escaping and sanitization functions (esc_html, wp_kses_post).
Ingestion points: Block configuration files (block.json), theme settings (blockstudio.json), and external API endpoints via the fetch populate mode.
Boundary markers: Not explicitly defined in the provided markdown files.
Capability inventory: Writing and executing PHP/Twig/Blade templates, file system writes for asset minification/SCSS compilation, and network requests via the populate feature.
Sanitization: Documentation mandates the use of esc_html(), esc_attr(), and wp_kses_post() for all output rendering.

blockstudio