paulund/standards-wordpress
standards-wordpress/SKILL.md
Use when developing WordPress themes, plugins, customizing Gutenberg blocks, implementing WooCommerce features, or optimizing WordPress performance and security.
$ install --global
skillsauthnpx skillsauth add paulund/ai standards-wordpressInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 5, 2026, 6:49 AM137.8s1 file scanned
SKILL.md
- name:
- standards-wordpress
- description:
- Use when developing WordPress themes, plugins, customizing Gutenberg blocks, implementing WooCommerce features, or optimizing WordPress performance and security.
- category:
- standards
Core Workflow
- Analyze requirements - Understand WordPress context, existing setup, goals
- Design architecture - Plan theme/plugin structure, hooks, data flow
- Implement - Build using WordPress standards, security best practices
- Optimize - Cache, query optimization, asset optimization
- Test & secure - Security audit, performance testing, compatibility checks
Constraints
MUST DO
- Follow WordPress Coding Standards (WPCS)
- Use nonces for form submissions
- Sanitize all user inputs with appropriate functions
- Escape all outputs (esc_html, esc_url, esc_attr)
- Use prepared statements for database queries
- Implement proper capability checks
- Enqueue scripts/styles properly (wp_enqueue_*)
- Use WordPress hooks instead of modifying core
- Write translatable strings with text domains
- Test across multiple WordPress versions
MUST NOT DO
- Modify WordPress core files
- Use PHP short tags or deprecated functions
- Trust user input without sanitization
- Output data without escaping
- Hardcode database table names (use $wpdb->prefix)
- Skip capability checks in admin functions
- Ignore SQL injection vulnerabilities
- Bundle unnecessary libraries (use WordPress APIs)
- Create security vulnerabilities through file uploads
- Skip internationalization (i18n)
Related Skills
paulund/test-driven-development
development
VerifiedTrustedCommunity
Use when implementing any logic, fixing any bug, or changing any behaviour. Use when you need to prove code works, when a bug report arrives, or when modifying existing functionality. Do NOT use for config changes, data migrations, or dependency updates.
3SKILL.mdUpdated Jul 1, 2026
paulund/spec-driven-development
development
VerifiedTrustedCommunity
Use when starting a new feature, when requirements are unclear, when asked to write code without a clear spec, or before any non-trivial implementation. Do NOT use for trivial bug fixes or one-line changes.
3SKILL.mdUpdated Jul 1, 2026
paulund/source-driven-development
development
VerifiedTrustedCommunity
Use when you want authoritative, source-cited code free from outdated patterns. Use when building with any framework or library where correctness matters. Detects the stack from dependency files, fetches official documentation, implements following documented patterns, and cites sources for every framework-specific decision.
3SKILL.mdUpdated Jul 1, 2026
paulund/shipping-and-launch
development
VerifiedTrustedCommunity
Use when preparing to ship a feature, release, or deployment. Use before merging to main, creating a release, or deploying to production. Do NOT use for CI-only changes or internal refactors that don't reach production.
3SKILL.mdUpdated Jul 1, 2026