WordPress/wp-project-triage
skills/wp-project-triage/SKILL.md
Use when you need a deterministic inspection of a WordPress repository (plugin/theme/block theme/WP core/Gutenberg/full site) including tooling/tests/version hints, and a structured JSON report to guide workflows and guardrails.
$ install --global
skillsauthnpx skillsauth add WordPress/agent-skills wp-project-triageInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
4 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
4
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 19, 2026, 5:27 PM246.4s3 files scanned
SKILL.md
- name:
- wp-project-triage
- description:
- Use when you need a deterministic inspection of a WordPress repository (plugin/theme/block theme/WP core/Gutenberg/full site) including tooling/tests/version hints, and a structured JSON report to guide workflows and guardrails.
- compatibility:
- Targets WordPress 6.9+ (PHP 7.2.24+). Filesystem-based agent with bash + node. Some workflows require WP-CLI.
WP Project Triage
When to use
Use this skill to quickly understand what kind of WordPress repo you’re in and what commands/conventions to follow before making changes.
Inputs required
- Repo root (current working directory).
Procedure
- Run the detector (prints JSON to stdout):
node skills/wp-project-triage/scripts/detect_wp_project.mjs
- If you need the exact output contract, read:
skills/wp-project-triage/references/triage.schema.json
- Use the report to select workflow guardrails:
- project kind(s)
- PHP/Node tooling present
- tests present
- version hints and sources
- If the report is missing signals you need, update the detector rather than guessing.
Verification
- The JSON should parse and include:
project.kind,signals, andtooling. - Re-run after changes that affect structure/tooling (adding
theme.json,block.json, build config).
Failure modes / debugging
- If it reports
unknown, check whether the repo root is correct. - If scanning is slow, add/extend ignore directories in the script.
Related Skills
WordPress/wp-abilities-verify
tools
VerifiedTrustedOfficial
Verify a WordPress plugin's Abilities API registrations: enumerate abilities, check that callback behavior matches each annotation's claim (the adversarial readonly-but-writes detection), validate permissions and schemas, and validate audit documents produced by wp-abilities-audit.
1,582SKILL.mdUpdated May 28, 2026
WordPress/wp-abilities-audit
tools
VerifiedTrustedOfficial
Audit a WordPress plugin's REST surface and produce a standardized audit document proposing Abilities API registrations. Produces a markdown doc with a YAML schema and prose sections that humans and agents can both consume when planning a registration rollout. Works on any WP plugin.
1,582SKILL.mdUpdated May 28, 2026
WordPress/wp-abilities-api
tools
VerifiedTrustedOfficial
Use when working with the WordPress Abilities API (wp_register_ability, wp_register_ability_category, /wp-json/wp-abilities/v1/*, @wordpress/abilities) including defining abilities, categories, meta, REST exposure, and permissions checks for clients.
1,582SKILL.mdUpdated Mar 19, 2026
WordPress/wp-plugin-directory-guidelines
tools
VerifiedTrustedOfficial
Use when reviewing WordPress plugins for GPL compliance, checking license headers or compatibility, evaluating upsell/freemium/trialware patterns, validating plugin naming or trademark rules, checking plugin slugs, understanding why a plugin was rejected from WordPress.org, or answering any question about the 18 WordPress.org Plugin Directory guidelines — even if the user doesn't mention 'guidelines' explicitly.
1,315SKILL.mdUpdated Apr 25, 2026