# Wordpress Scaffold

> Interview-driven workflow to scaffold a brand-new WordPress plugin. Asks for identity (name, slug, namespace), writes a constitution of defaults + strict allowlists, then generates a complete plugin with optional Settings page, REST API, Gutenberg blocks, and editor extensions. Use only when there is no existing plugin in the working directory — for adding features to an existing plugin, use word…

- **Type:** Skill
- **Install:** `agentstack add skill-pluginslab-wp-agentic-kit-wordpress-scaffold`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [pluginslab](https://agentstack.voostack.com/s/pluginslab)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [pluginslab](https://github.com/pluginslab)
- **Source:** https://github.com/pluginslab/wp-agentic-kit/tree/main/.claude/skills/wordpress-scaffold
- **Website:** https://pluginslab.com

## Install

```sh
agentstack add skill-pluginslab-wp-agentic-kit-wordpress-scaffold
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# WordPress Scaffold

Scaffolds a brand-new WordPress plugin through a short interview. **Greenfield only** — if a `*.php` file with a `Plugin Name:` header already exists in the working directory, stop and use the `wordpress-feature` skill.

## Phases

1. **Identity.** Ask one question at a time, don't continue without a clear answer:
   - Plugin name (e.g. "Order Tracker")
   - One-sentence description
   - Vendor prefix (optional, e.g. `acme`)
   - Slug — derive `acme-order-tracker` or `order-tracker`; confirm
   - PHP namespace — PascalCase from slug, e.g. `AcmeOrderTracker`; confirm

   Show the full identifier set before generating: slug, text domain (= slug), namespace, constant prefix, function prefix, options key.

2. **Constitution.** Write `.claude/plans/constitution.md` from the template in @.claude/references/PLANNING.md. The file has two binding levels:
   - **Default sections** (loose) — `@wordpress/*` packages, Composer deps, deploy lane, quality gates. Accept the template defaults unless the user wants different.
   - **Allowed sections** (strict, security-relevant) — sanitize functions, escape functions, capability constants, forbidden constructs. Match @.claude/references/SECURITY.md exactly.

   Confirm both before writing. The distinction is the point: treat everything as strict and the agent asks permission for trivia; treat nothing as strict and the plugin is one missing escape from disclosure.

3. **Feature selection.** Ask one at a time: Settings page? REST API? Gutenberg blocks (@.claude/references/BLOCKS.md)? Editor extensions?

4. **Spec + plan.** Create `.claude/plans/features/000-initial-scaffold/` and write `spec.md` + `plan.md` describing the initial scaffold. This becomes the project's first plan artifact.

5. **Generate.** Standard plugin layout: `{slug}.php` (bootstrap with header, `*_VERSION`/`*_PATH`/`*_URL`/`*_FILE` constants, single `get_instance()` class, top-level activation/deactivation hooks), `includes/class-utils.php`, `includes/class-settings.php` (if selected), `includes/api/class-rest.php` + `class-rest-example.php` (if selected), `src/blocks/test-block/` (if selected), `src/extensions/` (if selected), `languages/`, `package.json` (if blocks/extensions), `composer.json`, `phpcs.xml.dist`, `readme.txt`, `uninstall.php`, `.gitignore`. Every PHP file MUST start with the `ABSPATH` guard.

6. **Deliver.** Show the file tree. Print the three install commands (`composer install`, `npm install` if blocks/extensions, `npm run build` if blocks/extensions). Write `progress.md` with `status: complete, last_completed: scaffold` and immediately move `features/000-initial-scaffold/` to `.claude/plans/archive/{YYYY-MM-DD}-000-initial-scaffold/`. Offer to spin up `wp-playground` for a smoke test. Tell the user: **next features go through `wordpress-feature`.**

## Hard rules (this skill)

Every PHP file MUST start with `if ( ! defined( 'ABSPATH' ) ) { exit; }`. Every generated piece MUST follow @.claude/references/SECURITY.md — sanitize input, escape output, verify nonces, check capabilities, prepare queries. Constitution's **strict** sections bind hard; **default** sections are advisory.

## Naming (locked at scaffold)

- Slug: kebab-case (`acme-order-tracker`) · Text domain: same as slug, literal string
- Namespace: PascalCase (`AcmeOrderTracker`)
- Constants: `ACME_ORDER_TRACKER_*` · Functions: `acme_order_tracker_*`
- Class files: `class-{name}.php` · Hooks: namespaced action/filter names

## After generation

Remind the user to run `./vendor/bin/phpcs`, verify activation → deactivation → uninstall leaves no orphan data, commit `composer.lock` + `package-lock.json`, and run `security-reviewer` before the first PR.

## References

- @.claude/references/PLANNING.md — plan-file templates and rationale
- @.claude/references/SECURITY.md — complete security checklist
- @.claude/references/BLOCKS.md — Gutenberg block development patterns

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [pluginslab](https://github.com/pluginslab)
- **Source:** [pluginslab/wp-agentic-kit](https://github.com/pluginslab/wp-agentic-kit)
- **License:** MIT
- **Homepage:** https://pluginslab.com

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-pluginslab-wp-agentic-kit-wordpress-scaffold
- Seller: https://agentstack.voostack.com/s/pluginslab
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.