wp-agent-skills

216 skills · 28 plugins

A community-maintained collection of portable Agent Skills for WordPress plugin and theme development.

These skills give an AI coding assistant a concrete, version-tested playbook for common WordPress development tasks — security audits, scaffolding, REST API patterns, plugin-specific helpers (WooCommerce, JetEngine, JetFormBuilder, etc.) — so you spend less time re-explaining "the WordPress way" on every project.

Format. Every skill follows the open Agent Skills specification (plain Markdown + YAML frontmatter with the standard name / description / metadata fields), so the collection works with Claude Code, claude.ai, Codex, and any other Agent Skills-compatible client — directly or with a thin adapter (Cursor rules, Aider conventions, custom Agent SDK apps). The format is an open standard, not tied to a single vendor. Validate any skill with the official skills-ref reference tool: skills-ref validate <skill-dir>.

What's a skill?

A skill is a folder with a SKILL.md file that tells the agent when to use it and how to do the work. The runtime loads it on demand based on the YAML description in the frontmatter.

This repo is not a plugin, runtime, or framework. It's documentation that an AI consumes. There's nothing to install in your WordPress site.

Repository structure

Skills are grouped by domain. Each domain has its own README listing the skills it contains — open the domain you care about for the full table.

New domain folders follow the same convention: top-level folder per plugin (or plugin family), one subfolder per skill, each containing at minimum a SKILL.md. Larger skills may also include reference.md, examples/, or scripts/.

The folder layout is the source of truth — there is intentionally no flat list of every skill in this README. As the collection grows, the per-domain READMEs scale, this file does not.

Rules (always-on)

Alongside skills, the rules/ folder holds a small set of always-on invariants — short "always / never" baselines a tool injects into every code turn, rather than pulling in on demand. Skills are pulled (the router matches a description); rules are pushed (guaranteed present even when the router doesn't fire). See rules/README.md for the format and how to load them into Cursor, Windsurf, Copilot, Claude Code, or Antigravity.

Machine-readable index

The repository also publishes skills-index.json, a generated catalog of every skill, its domain, description, source path, raw SKILL.md URL, frontmatter metadata, and bundled resource files.

The index is intended for thin adapters, install scripts, websites, MCP servers, and other tooling that should not have to crawl the GitHub tree. It is generated from the folder layout:

npm install --no-save --no-package-lock js-yaml@4
node .github/scripts/build-skills-index.js

CI checks that skills-index.json stays in sync with the committed SKILL.md files.

Staying up to date

New skills land continuously. Instead of watching the repo, you can sync the collection into a local folder straight from the skills-index.json manifest — no clone, no fork, plain HTTPS. scripts/sync-skills.sh does exactly that, and is deliberately defensive because it writes files an agent will later read:

• Download URLs are reconstructed from a pinned repo base — the manifest is never used to decide which host to fetch from, so a tampered manifest cannot redirect a download elsewhere.
• Every manifest path is validated (no .., absolute paths, backslashes, ~, safe charset only) and confined under your destination directory.
• Every file is verified against the sha256 and byte size in the manifest before it is written; any mismatch is a hard failure and nothing partial or unverified is moved into place.
• HTTPS only (TLS ≥ 1.2), no redirect-following, per-file size cap.
• Downloaded files are written non-executable and the script never runs anything it downloads (skills are Markdown/YAML). It only adds/updates — it never deletes local files.
• It refuses to write through a pre-existing symlink (or any non-regular file) at a target path, so a planted link can't redirect a write outside the destination.

# sync everything into ./skills
sh scripts/sync-skills.sh

# …or point it at wherever YOUR agent runtime loads skills from — the script
# is not tied to any single tool:
sh scripts/sync-skills.sh ~/.claude/skills          # Claude Code, global
sh scripts/sync-skills.sh .claude/skills            # Claude Code, per-project
WP_SKILLS_DIR=/path/to/skills sh scripts/sync-skills.sh

# only some domains (space-separated allowlist)
WP_SKILLS_DOMAINS="woocommerce wordpress" sh scripts/sync-skills.sh ~/.claude/skills

Requires curl, jq, and sha256sum (or shasum). Re-running is cheap — unchanged files are detected by hash and skipped.

Trust model. The manifest is the trust root: you are trusting GitHub, serving this repository over TLS. The script guarantees you receive exactly the bytes this repo published (right host, right path, matching hash) and that nothing lands outside the directory you chose — it does not vouch for the content of the skills. Review third-party skills before pointing an agent at them, the same as any untrusted prompt input.

Using these skills

Claude Code

Symlink (or copy) the skills into your global skills directory:

# clone once
git clone https://github.com/Lonsdale201/wp-agent-skills.git ~/wp-agent-skills

# symlink the ones you want
mkdir -p ~/.claude/skills
ln -s ~/wp-agent-skills/wordpress/wp-security-audit ~/.claude/skills/wp-security-audit
ln -s ~/wp-agent-skills/wordpress/wp-i18n-audit     ~/.claude/skills/wp-i18n-audit
# ...etc

Or symlink a whole domain at once if you want everything from it.

Per-project (skills only available inside a specific repo):

mkdir -p .claude/skills
ln -s ~/wp-agent-skills/wordpress/wp-security-audit .claude/skills/wp-security-audit

claude.ai / Agent SDK

Upload the skill folder via the UI or SDK as documented in Anthropic's skills docs.

Other agent runtimes

The format is the open Agent Skills specification, so any Agent Skills-compatible client (Codex and others) loads these folders natively, and most other agent tools can consume them directly or with a thin adapter (e.g. symlink as a Cursor rule under .cursor/rules/, or include in an Aider read-list). The name, description, and body conventions are standardized; only the host runtime's loading mechanism differs. Collection-specific metadata (author, tested plugin versions, last-updated) travels in the spec's metadata map under the wp-skills-* namespace.

Triggering a skill

Once installed, just ask the agent in natural language:

• "Run a security audit on this plugin."
• "Check this file for i18n issues before I push."
• "Add a custom checkout field to WooCommerce."

The skill's description matches your intent and the agent loads it automatically. You can also force one explicitly: "Use the wp-security-deep skill on class-rest-controller.php."

Changelog

See CHANGELOG.md for what was added or updated and when. Entries are date-based — this is a continuously-evolving documentation collection, not a versioned release artifact.

Contributing

Read CONTRIBUTING.md for naming rules, the required frontmatter shape, the writing checklist, and the PR process.

There's a starter template at SKILL_TEMPLATE.md.

License

All skills in this repository are released under the MIT License unless a specific skill's folder declares otherwise. See LICENSE.

This is a non-commercial community project. Skills are documentation, not executable software — but they shape what AI does in your codebase, so quality and clarity matter.