CtrlK
BlogDocsLog inGet started
Tessl Logo

wp-plugin-development

Use when developing WordPress plugins: architecture and hooks, activation/deactivation/uninstall, admin UI and Settings API, data storage, cron/tasks, security (nonces/capabilities/sanitization/escaping), and release packaging.

73

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an exemplary lean overview: WordPress-specific guardrails with no filler, a numbered procedure ending in a verification checklist and a symptom-to-cause debugging section, and clean one-level-deep disclosure into six real reference files. The only notable gap is actionability — no copy-paste code examples for the security and settings patterns the body mandates, and one referenced triage script lives outside this bundle.

Suggestions

Inline one short copy-paste snippet for the most fragile patterns the body mandates, e.g., a correct activation-hook registration or a nonce + capability check pair in a settings form, to lift actionability to fully executable.

Clarify or vendor the external triage dependency: `node skills/wp-project-triage/scripts/detect_wp_project.mjs` references a script outside this bundle, so state the fallback if that skill is absent (or point to the bundled `detect_plugins.mjs` only).

Link the "## Verification" checklist items back to the procedure steps they validate (e.g., note that settings round-trip verification follows step 3) so the feedback loop is inline rather than only at the end.

DimensionReasoningScore

Conciseness

The body is ~106 lines of tight bullet guidance with zero explanation of concepts Claude already knows — e.g., "register activation/deactivation hooks at top-level, not inside other hooks", "Validate/sanitize input early; escape output late", "Use `wp_unslash()` and specific keys". Every line is a WordPress-specific guardrail or pointer; it matches anchor 5 ("lean and efficient; assumes Claude's competence; every token earns its place") rather than anchor 4, which requires instances of over-explanation that are absent here.

5 / 5

Actionability

Quotes: "`node skills/wp-plugin-development/scripts/detect_plugins.mjs`", "`register_setting()`, `add_settings_section()`, `add_settings_field()`", "`uninstall.php` or `register_uninstall_hook`", "Use `$wpdb->prepare()` for SQL" — concrete commands, function names, and file conventions. Not anchor 5: beyond the two detection scripts there is no copy-paste-ready code (e.g., a nonce+capability check pattern or an activation-hook registration snippet), and the triage command references an external skill path (`skills/wp-project-triage/...`) not present in this bundle. Not anchor 3: the guidance names exact APIs and files, far beyond pseudocode.

4 / 5

Workflow Clarity

The procedure is a clearly numbered sequence (0) Triage → 1) Architecture → 2) Lifecycle → 3) Settings → 4) Security → 5) Data/cron, followed by an explicit "## Verification" checklist ("Plugin activates with no fatals/notices", "Uninstall removes intended data (and nothing else)", "Run repo lint/tests") and a "## Failure modes / debugging" section mapping symptoms to causes ("Activation hook not firing: hook registered incorrectly..."). This matches anchor 5 (explicit validation steps, feedback loops for error recovery, checklists); the destructive uninstall operation does have validation, so no cap applies.

5 / 5

Progressive Disclosure

The body is a concise overview that splits detail into six one-level-deep reference files, each clearly signaled per section ("See: `references/structure.md`", "`references/lifecycle.md`", "`references/settings-api.md`", "`references/security.md`", "`references/data-and-cron.md`", "`references/debugging.md`"). All six files exist in the bundle, contain real content, and contain no further nested references (verified by grep), and `scripts/detect_plugins.mjs` exists. This matches anchor 5 ("clear overview with well-signaled one-level-deep references; content appropriately split") rather than anchor 4, which requires organization gaps that are not present.

5 / 5

Total

19

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with an explicit 'Use when' trigger, a well-scoped WordPress plugin niche, and a comprehensive enumeration of capability areas. It is written in third person and free of fluff. The main room for improvement is phrasing capabilities as actions rather than topic nouns and adding a few more natural trigger synonyms.

Suggestions

Recast the capability list with action verbs (e.g., "Build plugin architecture, register hooks and lifecycle callbacks, add Settings API admin pages, harden security with nonces/capabilities/sanitization, package releases") to move from topic nouns to concrete actions.

Add natural trigger variations users might say, such as "plugin boilerplate", "plugin settings page", "plugin security review", or "PHP plugin code", to broaden trigger-term coverage.

Mention typical artifacts by name (e.g., "uninstall.php", "readme.txt", main plugin file header) to further sharpen distinctiveness against generic PHP or theme-development skills.

DimensionReasoningScore

Specificity

Quotes: "architecture and hooks, activation/deactivation/uninstall, admin UI and Settings API, data storage, cron/tasks, security (nonces/capabilities/sanitization/escaping), and release packaging" — seven concrete capability areas with parenthetical sub-detail, comprehensive for the domain. It falls between anchor 4 and 5: coverage is broad, but the items are enumerated as topic nouns rather than the concrete action verbs of the anchor-5 example ("Extract text... fill forms..."), so it matches "lists several specific actions; minor gaps" better than full anchor 5.

4 / 5

Completeness

Quote: "Use when developing WordPress plugins: ..." explicitly answers 'when' with a concrete trigger clause, and the enumerated list (architecture/hooks, lifecycle, settings, security, packaging) explicitly answers 'what' the skill covers. This matches anchor 5 ("clearly and explicitly answers both what AND when") rather than anchor 4, whose 'when' is less explicit or less specific.

5 / 5

Trigger Term Quality

Quotes: "developing WordPress plugins", "hooks", "activation/deactivation/uninstall", "Settings API", "nonces", "cron/tasks", "release packaging" — these are phrases users would naturally say when needing this skill. Not anchor 5 because common variations are missing (e.g., "PHP", "wp-admin", "plugin settings page", "plugin update/release"); not anchor 3 because keyword coverage goes well beyond a single domain phrase.

4 / 5

Distinctiveness Conflict Risk

Quote: "Use when developing WordPress plugins" plus distinctive terms like "activation/deactivation/uninstall", "Settings API", and "nonces/capabilities" carve out a clear niche that would not plausibly trigger for non-WordPress skills. It matches anchor 5 ("clear niche with distinct triggers; minimal conflict risk"); anchor 4 would require noticeable overlap with a closely related skill, which is not present.

5 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
WordPress/agent-skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.