WordPress/wordpress-router
skills/wordpress-router/SKILL.md
Use when the user asks about WordPress codebases (plugins, themes, block themes, Gutenberg blocks, WP core checkouts) and you need to quickly classify the repo and route to the correct workflow/skill (blocks, theme.json, REST API, WP-CLI, performance, security, testing, release packaging).
$ install --global
skillsauthnpx skillsauth add WordPress/agent-skills wordpress-routerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
4 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
4
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 19, 2026, 5:23 PM392.6s2 files scanned
SKILL.md
- name:
- wordpress-router
- description:
- Use when the user asks about WordPress codebases (plugins, themes, block themes, Gutenberg blocks, WP core checkouts) and you need to quickly classify the repo and route to the correct workflow/skill (blocks, theme.json, REST API, WP-CLI, performance, security, testing, release packaging).
- compatibility:
- Targets WordPress 6.9+ (PHP 7.2.24+). Filesystem-based agent with bash + node. Some workflows require WP-CLI.
WordPress Router
When to use
Use this skill at the start of most WordPress tasks to:
- identify what kind of WordPress codebase this is (plugin vs theme vs block theme vs WP core checkout vs full site),
- pick the right workflow and guardrails,
- delegate to the most relevant domain skill(s).
Inputs required
- Repo root (current working directory).
- The user’s intent (what they want changed) and any constraints (WP version targets, WP.com specifics, release requirements).
Procedure
- Run the project triage script:
node skills/wp-project-triage/scripts/detect_wp_project.mjs
- Read the triage output and classify:
- primary project kind(s),
- tooling available (PHP/Composer, Node, @wordpress/scripts),
- tests present (PHPUnit, Playwright, wp-env),
- any version hints.
- Route to domain workflows based on user intent + repo kind:
- For the decision tree, read:
skills/wordpress-router/references/decision-tree.md.
- For the decision tree, read:
- Apply guardrails before making changes:
- Confirm any version constraints if unclear.
- Prefer the repo’s existing tooling and conventions for builds/tests.
Verification
- Re-run the triage script if you create or restructure significant files.
- Run the repo’s lint/test/build commands that the triage output recommends (if available).
Failure modes / debugging
- If triage reports
kind: unknown, inspect:- root
composer.json,package.json,style.css,block.json,theme.json,wp-content/.
- root
- If the repo is huge, consider narrowing scanning scope or adding ignore rules to the triage script.
Escalation
- If routing is ambiguous, ask one question:
- “Is this intended to be a WordPress plugin, a theme (classic/block), or a full site repo?”
Related Skills
WordPress/wp-abilities-verify
tools
VerifiedTrustedOfficial
Verify a WordPress plugin's Abilities API registrations: enumerate abilities, check that callback behavior matches each annotation's claim (the adversarial readonly-but-writes detection), validate permissions and schemas, and validate audit documents produced by wp-abilities-audit.
1,582SKILL.mdUpdated May 28, 2026
WordPress/wp-abilities-audit
tools
VerifiedTrustedOfficial
Audit a WordPress plugin's REST surface and produce a standardized audit document proposing Abilities API registrations. Produces a markdown doc with a YAML schema and prose sections that humans and agents can both consume when planning a registration rollout. Works on any WP plugin.
1,582SKILL.mdUpdated May 28, 2026
WordPress/wp-abilities-api
tools
VerifiedTrustedOfficial
Use when working with the WordPress Abilities API (wp_register_ability, wp_register_ability_category, /wp-json/wp-abilities/v1/*, @wordpress/abilities) including defining abilities, categories, meta, REST exposure, and permissions checks for clients.
1,582SKILL.mdUpdated Mar 19, 2026
WordPress/wp-plugin-directory-guidelines
tools
VerifiedTrustedOfficial
Use when reviewing WordPress plugins for GPL compliance, checking license headers or compatibility, evaluating upsell/freemium/trialware patterns, validating plugin naming or trademark rules, checking plugin slugs, understanding why a plugin was rejected from WordPress.org, or answering any question about the 18 WordPress.org Plugin Directory guidelines — even if the user doesn't mention 'guidelines' explicitly.
1,315SKILL.mdUpdated Apr 25, 2026