Install
$ agentstack add skill-pluginslab-wp-agentic-kit-wordpress-feature ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
WordPress Feature
Adds features (block, REST, settings, extension, CPT, taxonomy, CLI command) and maintenance edits (typos, version bumps) to an existing WordPress plugin. If no main plugin file (*.php with a Plugin Name: header) is present, stop and use the wordpress-scaffold skill.
Mode
Decide first: feature (gets spec + plan, possibly its own PR) or maintenance (typo / version bump / micro-fix; one-line log). Ask if unsure.
Feature mode
- Context. Find the main plugin file. Read its constants, namespace, text domain — match the existing conventions exactly. Read
.claude/plans/constitution.md; offer to backfill from the codebase if missing. - Spec. Allocate
.claude/plans/features/NNN-feature-slug/(next zero-padded number). Writespec.mdfrom the template in @.claude/references/PLANNING.md. End with an explicitOut of scopesection. - Plan. Write
plan.mdfrom the same template. Phased steps, file paths in every step, tests encouraged before each implementation step. Fill the Freeze assessment checklist honestly at the end. - Freeze decision. Read the assessment's recommendation:
- freeze (any box checked): run
./scripts/open-plan-pr.sh NNN-slug, dispatch theplan-reviewersub-agent against the PR, stop and wait for the human-merged plan PR before starting step 5. - proceed (no boxes checked): create
feat/NNN-slug, commitspec.md+plan.mdas the first commit, surface the assessment to the user, start step 5. - The user can override either direction.
- Implement. After the plan PR merges (or immediately for "proceed"), mirror open plan steps into the harness task tool (e.g.
TaskCreateif available). Tick off as you go; append toprogress.md. - Findings (lazy). When an MCP lookup (
wp-devdocs,wp-blockmarkup) surfaces a non-obvious fact that shaped the code, append tofindings.md. Skip if nothing surprised you. - Ship. Run
./scripts/quality.sh. Open the feature PR. Dispatchsecurity-revieweron the diff. After merge, archive the feature dir to.claude/plans/archive/{YYYY-MM-DD}-{slug}/.
Maintenance mode
Confirm "skipping spec/plan, ok?" → make the change → append a one-liner to the active feature's progress.md (or .claude/plans/maintenance.md if no feature is active):
2026-05-18 — Bumped version to 1.2.4 for security patch.
Hard rules (this skill)
- NEVER generate code in feature mode without a
plan.mdin the active feature dir. - NEVER start step 5 (implement) if the Freeze assessment recommends freeze and the plan PR hasn't merged.
- NEVER ship a blank or dishonest Freeze assessment. The
plan-reviewercatches it. - NEVER use a sanitizer, escaper, capability constant, or otherwise-forbidden construct that isn't in the constitution's strict sections. Dependencies (npm / Composer) follow the default sections — extend when needed, note why in
findings.md.
For the universal security checklist (ABSPATH, sanitize, escape, nonce, capability, prepare) see @.claude/references/SECURITY.md. CLAUDE.md repeats the load-bearing ones at the top of every session.
Naming
- Feature dir:
NNN-kebab-slug(e.g.001-order-status-block) - Plan branch:
plan/NNN-slug· Feature branch:feat/NNN-slug - Plugin slug, namespace, prefixes: match what's already in the plugin — they were locked at scaffold time.
References
- @.claude/references/PLANNING.md — plan-file templates + rationale + freeze assessment
- @.claude/references/SECURITY.md — full security checklist with code patterns
- @.claude/references/BLOCKS.md — Gutenberg block development patterns
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: pluginslab
- Source: pluginslab/wp-agentic-kit
- License: MIT
- Homepage: https://pluginslab.com
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.