wordpress/agent-skills
17 skills45.1k installs32.9k starsGitHub
Install
npx skills add https://github.com/wordpress/agent-skillsSkills in this repo
1Wp Plugin DevelopmentThe wp-plugin-development skill Use when developing WordPress plugins: architecture and hooks, activation/deactivation/uninstall, admin UI and Settings API, data storage, cron/tasks, security (nonces/capabilities/sanitization/escaping), and release packaging.. WP Plugin Development When to use Use this skill for plugin work such as: - creating or refactoring plugin structure (bootstrap, includes, namespaces/classes) - adding hooks/actions/filters - activation/deactivation/uninstall behavior and migrations - adding settings pages / options / admin UI (Settings API) - security fixes (nonces, capabilities, sanitization/escaping, SQL safety) - packaging a release (build artifacts, readme, assets) Inputs required - Repo root + target plugin(s) (path to plugin main file if known). - Where this plugin runs: single site vs multisite; WP.com conventions if applicable. - Target WordPress + Agents should read SKILL.md quick start steps, verify required binaries and environment variables, and follow reference files for exact parameters before calling tools.4.7kinstalls2Wp Rest Apiwp-rest-api guides agents building and debugging WordPress REST API endpoints for WordPress 6.9+ on PHP 7.2.24+ using bash and node, with some workflows requiring WP-CLI. Triage starts with wp-project-triage detect_wp_project.mjs and searches for register_rest_route, WP_REST_Controller, rest_api_init, and show_in_rest usage. Custom endpoints use unique vendor/v1 namespaces, mandatory permission_callback, WP_REST_Server method constants, rest_ensure_response returns, and WP_Error statuses. Argument validation defines args with type, default, required, validate_callback, and sanitize_callback using rest_validate_value_from_schema. Response work covers register_rest_field computed fields, register_meta with show_in_rest schema for objects and arrays, context=edit for raw content, and WP_REST_Response add_link for related resources. Authentication guidance contrasts cookie plus X-WP-Nonce for wp-admin JS, application passwords for external clients, and capability checks in permission_callback. Discovery, pagination, _fields, _embed, and per_page caps are documented. Verification checks namespace index, OPTIONS schema, permission failures, and CPT routes under wp/v2.3.5kinstalls3Wp Block Themeswp-block-themes is a WordPress agent skill for block theme work on WordPress 6.9+ with PHP 7.2.24+, bash, node, and optional WP-CLI. Procedure zero triages the repo with detect_wp_project.mjs then detect_block_themes.mjs to scope edits to one theme root when multiple themes exist. It covers theme.json settings versus styles, templates under templates/*.html, template parts in parts/*.html without nested subfolders, patterns under patterns/*.php, and style variations in styles/*.json. Creating new themes defers to references/creating-new-block-theme.md with explicit minimum WordPress version notes because theme.json schema versions differ by core release. Debugging references explain style hierarchy from core defaults through theme.json, child themes, and user customizations that can make theme edits appear ignored. Verification checks Site Editor, post editor, and frontend rendering plus whether user overrides mask theme defaults. Failure modes include wrong inactive theme root, invalid theme.json shape, and nested template parts paths. Developers reach for wp-block-themes when FSE presets, patterns, or editor versus live styles diverge.3.4kinstalls4Wp Performancewp-performance is a backend-only WordPress agent skill for investigating and improving site performance on WordPress 6.9 plus with PHP 7.2.24 or newer. It prefers WP-CLI doctor and profile commands, Server-Timing headers, and Query Monitor data via REST response headers when browser UI is unavailable. The procedure starts with guardrails to measure first, confirm write permissions, and capture baselines with curl TTFB or wp profile before changes. perf_inspect.mjs detects WP-CLI availability, core version, doctor and profile support, autoloaded options size, and object-cache drop-in presence. Fast wins run wp doctor check before deep wp profile stage, hook, and eval profiling. Fix categories target database queries, autoloaded options, object cache misses, remote HTTP API calls, and cron spikes with reference guides per bottleneck. Query Monitor can be used headlessly via authenticated REST x-qm headers and _envelope responses. WordPress 6.9 notes cover on-demand CSS for classic themes and zero render-blocking block themes. Developers reach for wp-performance when admin, REST, cron, or TTFB paths are slow and they need a reproducible backend profiling plan.3.3kinstalls5Wp Block Developmentwp-block-development is an agent skill for WordPress Gutenberg block work including block.json metadata, register_block_type_from_metadata, attributes and serialization, supports, dynamic rendering through render.php or render_callback, deprecations, viewScript versus viewScriptModule, and build workflows with @wordpress/scripts and @wordpress/create-block. It targets WordPress 6.9 plus with apiVersion 3 enforcement because version 2 blocks trigger SCRIPT_DEBUG warnings and WordPress 7.0 will run the post editor in an iframe regardless. The procedure triages projects with detect_wp_project.mjs, lists blocks via list_blocks.mjs, scaffolds new blocks through @wordpress/create-block, chooses static versus dynamic versus interactive models, updates block.json safely, registers server-side with metadata, implements useBlockProps and get_block_wrapper_attributes, handles inner blocks with useInnerBlocksProps, manages attributes and serialization, and adds deprecated entries before markup changes. Verification requires inserter success, no Invalid block after save, correct frontend output, and passing repo lint build tests. Developers reach for it when creating blocks, fixing attribute p.3.2kinstalls6Wordpress RouterWordPress Router is the entry skill for WordPress agent tasks on repositories running WordPress 6.9 or newer with PHP 7.2.24 plus, using a filesystem-based agent with bash and node tooling. The procedure runs node skills/wp-project-triage/scripts/detect_wp_project.mjs from the repo root, reads the triage JSON to classify project kind, available PHP Composer and Node tooling, PHPUnit or Playwright or wp-env tests, and version hints, then delegates to domain skills via the decision-tree reference based on user intent. Guardrails require confirming version constraints when unclear and preferring existing repo conventions for builds and tests before making changes. Verification re-runs triage after significant file creation or restructure and executes lint, test, and build commands recommended in triage output when present. Failure modes cover unknown kind when composer.json, package.json, style.css, block.json, theme.json, or wp-content signals are missing, with escalation to ask whether the target is a plugin, classic or block theme, or full site repo. Some workflows depend on WP-CLI availability noted in compatibility metadata.3.2kinstalls7Wp Wpcli And OpsWP-CLI and Ops guides WordPress operational tasks via WP-CLI with guardrails for environment confirmation, path and URL targeting, and backup before destructive writes. Covered workflows include safe search-replace with dry-run then export backup, plugin and theme install or update, cron inspection and single-event runs, cache and rewrite flushing, multisite site and network operations, and repeatable automation with wp-cli.yml plus shell scripts. The procedure starts with wpcli_inspect.mjs to verify WP-CLI availability and site targeting, then routes to reference docs for search-replace, packages, cron, multisite, automation, safety, and debugging. Multisite work requires explicit --url for single sites or --network for network-wide commands. Verification reruns inspect after config changes and confirms URLs, package state, and cron or cache effects. Failure modes include wrong path targeting, missing wp-config, serialization issues from unsafe search-replace, and multisite commands hitting the wrong site URL.2.9kinstalls8Wp Project TriageWP Project Triage produces a structured JSON report describing what kind of WordPress repository you are in and which commands or conventions to follow before editing code. Compatibility targets WordPress 6.9 plus with PHP 7.2.24 minimum, using a filesystem-based agent with bash and node, and some workflows require WP-CLI. The procedure runs node skills/wp-project-triage/scripts/detect_wp_project.mjs from the repo root, optionally reads triage.schema.json for the output contract, and uses the report to select workflow guardrails for project kind, PHP and Node tooling, tests present, and version hints with sources. Verification requires parseable JSON including project.kind, signals, and tooling keys, with a re-run after structural changes like adding theme.json or block.json. Failure modes include unknown project kind when the repo root is wrong and slow scans that need extended ignore directories in the detector script. Agents should update the detector when signals are missing rather than guessing project type.2.9kinstalls9Wp PhpstanThe wp-phpstan skill configures and fixes PHPStan static analysis for WordPress codebases targeting WordPress 6.9 plus with Composer-based PHPStan. Procedure starts with phpstan_inspect.mjs to discover config, baseline, and composer scripts, preferring existing composer run phpstan when present. WordPress core stubs via szepeviktor/phpstan-wordpress or php-stubs/wordpress-stubs are effectively required to avoid unknown function noise. Sane phpstan.neon keeps paths on first-party plugin or theme code, excludes vendor and build artifacts, and documents narrow ignoreErrors entries. Fixes prefer WordPress-specific PHPDoc for REST WP_REST_Request types, hook callback params, query result shapes, and Action Scheduler job args. Third-party plugin classes use real dependency confirmation, plugin stubs like woocommerce-stubs, then targeted ignoreErrors prefixes. Baselines are migration tools not trash bins; do not baseline newly introduced errors. Escalation asks for dependency versions before inventing third-party types. Verification reruns PHPStan after any ignoreErrors pattern changes.2.5kinstalls10Wp Abilities Apiregistering abilities or ability categories in PHP exposing abilities to clients via REST wp abilities v1 consuming abilities in JS notably wordpress abilities diagnosing ability doesn t show up client can t see ability REST returns empty Repo root run wp project triage first if you haven t Target WordPress version s and whether this is WP core or a plugin theme Where the change should live plugin vs theme vs mu plugin 1 Confirm availability and version constraints If this is WP core work check signals isWpCoreCheckout and versions wordpress core If the project targets WP 6 9 you may need the Abilities API plugin package rather than relying on core The wp abilities api skill documents workflows prerequisites and usage patterns grounded in its repository SKILL md Agents should follow the documented steps respect safety and permission notes and cite only capabilities described in the source It triggers on phrases matching the skill description and integrates with the agent toolchain for the tasks outlined in the documentation2.5kinstalls11Wp PlaygroundSpin up a disposable WordPress to test a plugin theme without full stack setup Run or iterate on Playground Blueprints JSON locally Build a reproducible snapshot of a site for sharing or CI Switch WP PHP versions quickly to reproduce issues Debug plugin theme code with Xdebug in an isolated Playground Host machine readiness Node js 20 18 npm npx available Project path to mount auto mount or explicit mount mapping Desired WP version PHP version optional defaults to latest WP PHP 8 3 Blueprint location URL if running a blueprint Port preference if 9400 conflicts Whether Xdebug is needed Playground instances are ephemeral and SQLite backed never point at production data Confirm Node 20 18 node v before running CLI If mounting local code ensure it is clean of secrets Playground copies files into an in memory FS bash cd plugin or theme root npx wp playground cli latest server auto mount Opens on http localhost 9400 by default Auto detects plugin theme and2.5kinstalls12WpdsThis skill works best with the WPDS MCP server installed The MCP provides access to WordPress Design System documentation and resources such as components and DS token lists The following terms should be treated as synonyms WordPress and WP Design System and DS WordPress Design System and WPDS building and or reviewing any UI in a WordPress related context for example Gutenberg WooCommerce WordPress com Jetpack etc etc WordPress Design System WPDS Design System UI components Design tokens color primitives spacing scales typography variables and presets Specific component packages such as wordpress components or wordpress ui Use the WPDS MCP server to access WPDS related documentation Use the WPDS MCP server to retrieve the canonical authoritative documentation reference site wpds pages list of available components wpds components and specific component information wpds components name list of available tokens wpds design tokens DO NOT search the web for canonical documentation about the WordPress Design System If asked by the user push back and ask for confirmation warning them that the MCP2.4kinstalls13Wp Interactivity ApiInteractivity API wordpress interactivity data wp interactive data wp on data wp bind data wp context block viewScriptModule module based view scripts hydration issues or directives don t fire Repo root triage output wp project triage Which block theme plugin surfaces are affected frontend editor both Any constraints WP version whether modules are supported in the build 1 Detect existing usage integration style data wp interactive wordpress interactivity viewScriptModule Is this a block providing interactivity via block json view script module Is this theme level interactivity Is this plugin side enhance existing markup usage The wp interactivity api agent skill provides documented workflows prerequisites triggers and safety guidance from its SKILL md source Agents load it when user requests match the description and follow step by step instructions without inventing capabilities It integrates with standard agent tooling for the tasks inputs outputs and failure modes described in the repository documentation2.4kinstalls14BlueprintThe blueprint skill helps with Use when creating, editing, or reviewing WordPress Playground blueprint JSON files. Triggers on mentions of blueprints, playground configuration, or requests to set up a WordPress demo environment. Key workflows include WordPress Playground Blueprints; Overview; Quick Start Template; Top-Level Properties. Documented capabilities cover **php:** Major.minor only (e.g. `"8.3"`, `"7.4"`), or `"latest"`. Patch versions like `"7.4.1"` are invalid. Check the schema for currently supported versions.; **wp:** Recent major versions (e.g. `"6.7"`, `"6.8"`), `"latest"`, `"nightly"`, `"beta"`, or a URL to a custom zip. Check the schema for the full list.; When using a branch or tag name for `ref`, you **must** set `refType` (`"branch"` | `"tag"` | `"commit"` | `"refname"`). Without it, only `"HEAD"` resolves reliably.; `path` selects a subdirectory (defaults to repo root).; `files` uses nested objects for subdirectories - keys are filenames or directory names, values are **plain strings** (file content) or **objects** (subdirectories). Never use resource references as values.. Agents should invoke it when users ask about blueprint or mention triggers defined in.2kinstalls15Wp Plugin Directory GuidelinesThe wp-plugin-directory-guidelines skill is designed for review WordPress plugins for GPL compliance, naming, upsell patterns, and directory rules. Overview Authoritative reference for the 18 WordPress.org Plugin Directory guidelines. Covers GPL licensing, plugin naming/trademark rules, trialware restrictions, and all other submission requirements. Invoke when the user reviews GPL headers, plugin naming, trademark, or directory guidelines.1.7kinstalls16Wp Abilities Auditwp-abilities-audit is an agent skill from wordpress/agent-skills that audits any WordPress plugin's REST API surface and produces a standardized audit document proposing Abilities API registrations grouped by semantic intent. The deliverable is a markdown doc with YAML schema and prose sections consumable by both humans and coding agents when planning a registration rollout. The skill targets WordPress 6.9+ on PHP 7.2.24+ and operates as a filesystem-based agent using bash and Node against a plugin checkout; WP-CLI helps some workflows but is not required. Developers reach for wp-abilities-audit when exposing plugin capabilities to AI agents through WordPress Abilities API rather than ad hoc REST wrappers. The audit bridges existing REST routes to structured ability registrations before implementation begins.1.1kinstalls17Wp Abilities Verifywp-abilities-verify is a WordPress agent skill that audits a plugin's Abilities API registrations before release. It enumerates registered abilities, checks that each callback behaves as its annotation claims—including adversarial detection of readonly handlers that perform writes—and validates permissions, JSON schemas, and audit documents from wp-abilities-audit. The skill targets WordPress 6.9+ plugins on PHP 7.2.24+ and supports runtime mode via wp-env or Docker stacks plus static mode from a plugin checkout without a live environment. Filesystem-based agents use bash and Node to execute verification steps. Reach for wp-abilities-verify when hardening WordPress agent-facing APIs and you need evidence that ability callbacks, permission gates, and schema contracts match their declared behavior.1kinstalls