Install
$ agentstack add skill-pluginslab-wp-agentic-kit-wordpress-feature ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
WordPress Feature
Adds features (block, REST, settings, extension, CPT, taxonomy, CLI command) and maintenance edits (typos, version bumps) to an existing WordPress plugin. If no main plugin file (*.php with a Plugin Name: header) is present, stop and use the wordpress-scaffold skill.
Mode
Decide first: feature (gets spec + plan, possibly its own PR) or maintenance (typo / version bump / micro-fix; one-line log). Ask if unsure.
Feature mode
- Context. Find the main plugin file. Read its constants, namespace, text domain — match the existing conventions exactly. Read
.claude/plans/constitution.md; offer to backfill from the codebase if missing. - Spec. Allocate
.claude/plans/features/NNN-feature-slug/(next zero-padded number). Writespec.mdfrom the template in @.claude/references/PLANNING.md. End with an explicitOut of scopesection. - Plan. Write
plan.mdfrom the same template. Phased steps, file paths in every step, tests encouraged before each implementation step. Fill the Freeze assessment checklist honestly at the end. - Freeze decision. Read the assessment's recommendation:
- freeze (any box checked): run
./scripts/open-plan-pr.sh NNN-slug, dispatch theplan-reviewersub-agent against the PR, stop and wait for the human-merged plan PR before starting step 5. - proceed (no boxes checked): create
feat/NNN-slug, commitspec.md+plan.mdas the first commit, surface the assessment to the user, start step 5. - The user can override either direction.
- Implement. After the plan PR merges (or immediately for "proceed"), mirror open plan steps into the harness task tool (e.g.
TaskCreateif available). Tick off as you go; append toprogress.md. - Findings (lazy). When an MCP lookup (
wp-devdocs,wp-blockmarkup) surfaces a non-obvious fact that shaped the code, append tofindings.md. Skip if nothing surprised you. - Ship. Run
./scripts/quality.sh. Open the feature PR. Dispatchsecurity-revieweron the diff. After merge, archive the feature dir to.claude/plans/archive/{YYYY-MM-DD}-{slug}/.
Maintenance mode
Confirm "skipping spec/plan, ok?" → make the change → append a one-liner to the active feature's progress.md (or .claude/plans/maintenance.md if no feature is active):
2026-05-18 — Bumped version to 1.2.4 for security patch.
Hard rules (this skill)
- NEVER generate code in feature mode without a
plan.mdin the active feature dir. - NEVER start step 5 (implement) if the Freeze assessment recommends freeze and the plan PR hasn't merged.
- NEVER ship a blank or dishonest Freeze assessment. The
plan-reviewercatches it. - NEVER use a sanitizer, escaper, capability constant, or otherwise-forbidden construct that isn't in the constitution's strict sections. Dependencies (npm / Composer) follow the default sections — extend when needed, note why in
findings.md.
For the universal security checklist (ABSPATH, sanitize, escape, nonce, capability, prepare) see @.claude/references/SECURITY.md. CLAUDE.md repeats the load-bearing ones at the top of every session.
Naming
- Feature dir:
NNN-kebab-slug(e.g.001-order-status-block) - Plan branch:
plan/NNN-slug· Feature branch:feat/NNN-slug - Plugin slug, namespace, prefixes: match what's already in the plugin — they were locked at scaffold time.
References
- @.claude/references/PLANNING.md — plan-file templates + rationale + freeze assessment
- @.claude/references/SECURITY.md — full security checklist with code patterns
- @.claude/references/BLOCKS.md — Gutenberg block development patterns
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: pluginslab
- Source: pluginslab/wp-agentic-kit
- License: MIT
- Homepage: https://pluginslab.com
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.