CtrlK
BlogDocsLog inGet started
Tessl Logo

wp-guard

Review generated or changed WordPress code — plugins, themes, and blocks — before it ships. Best used reactively after an agent writes, edits, or reviews code touching WordPress APIs: add_action/add_filter, shortcodes, meta boxes, AJAX handlers, REST routes, WP_Query or $wpdb, widgets, or WP-CLI commands. Use on 'review this plugin', 'is this safe to ship', 'make this translatable', 'speed up this query', or after tasks like 'write a plugin' or 'add an endpoint/shortcode/meta box'. Enforces escaping and sanitization, nonces plus capability checks, prepared database queries, core-API-first development, translation-ready strings, and query/caching discipline. DO NOT USE for WooCommerce-specific order, product, or checkout logic (use woo-guard), non-WordPress PHP, generic code quality review (use clean-code-guard), test code review (use test-guard), server or hosting configuration, or conceptual WordPress questions.

80

Quality

100%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

100%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tight, highly actionable guard-pass skill: concrete function-level rules, an explicit validation self-check, and a clean one-level reference structure. It satisfies all four content dimensions at the top anchor with no notable weaknesses.

DimensionReasoningScore

Conciseness

The body is lean and action-dense — numbered rules name exact functions (esc_html, wp_unslash, $wpdb->prepare, wp_remote_get) with no explaining of basic concepts Claude already knows. The brief 'These rules exist because ...' rationale frames review priorities rather than padding, so it sits at the lean-and-efficient anchor and not the mostly-efficient-but-could-tighten level 2.

3 / 3

Actionability

Gives concrete executable guidance: exact function names per rule, grep patterns in the self-check ('Grep your diff for echo, print, <?='), and a copy-paste reporting-format template. As an instruction-only guard skill its specificity is fully actionable, so it is not the level-2 'pseudocode / missing key details' anchor.

3 / 3

Workflow Clarity

Sequences a multi-step process with explicit validation: 'Adapt to the project first' (1-4), numbered Rules 1-11, an 8-item 'Self-check before delivery' checklist, and 'If any answer is wrong, fix it before showing the user'. The validation checkpoint is explicit, matching the clear-sequence-with-checklists anchor rather than the level-2 gaps anchor.

3 / 3

Progressive Disclosure

SKILL.md is an overview with well-signaled one-level-deep references — a dedicated References section plus inline 'Details: [references/performance.md]' links — and detail (function tables, checklists) is split into references/security.md, i18n.md, performance.md, review-checklist.md, sources.md, all of which exist. The only sibling cross-links (review-checklist→i18n, security→sources) stay within the same bundle and do not create the 2+-level nesting of the level-1 anchor, so it remains at the well-organized top anchor.

3 / 3

Total

12

/

12

Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is comprehensive, action-specific, and rich with natural trigger phrases, while explicitly carving out sibling-skill boundaries to avoid conflicts. It cleanly satisfies all four dimensions at the top anchor.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'Review generated or changed WordPress code' and 'Enforces escaping and sanitization, nonces plus capability checks, prepared database queries, core-API-first development, translation-ready strings, and query/caching discipline' — matching the multiple-specific-actions anchor. Voice stays third person ('Review', 'Best used', 'Enforces'), so no specificity penalty applies; it is not the level-2 anchor because the action list is comprehensive rather than partial.

3 / 3

Completeness

Explicitly answers both what (reviews/enforces WordPress code rules) and when ('Best used reactively after an agent writes, edits, or reviews code touching WordPress APIs' and 'Use on ...'). Not level 2 because the 'when' is explicit with named triggers rather than merely implied.

3 / 3

Trigger Term Quality

Covers natural phrasings a user would actually say — 'review this plugin', 'is this safe to ship', 'make this translatable', 'speed up this query', 'write a plugin', 'add an endpoint/shortcode/meta box' — plus concrete API names (add_action, REST routes, WP_Query). Not level 2 because it covers common variations rather than only some relevant keywords.

3 / 3

Distinctiveness Conflict Risk

Clear WordPress-code-review niche with an explicit 'DO NOT USE for WooCommerce-specific ... (use woo-guard), non-WordPress PHP, generic code quality review (use clean-code-guard), test code review (use test-guard) ...' boundary, making wrong-skill conflicts unlikely. Not level 2 because the boundaries are explicit and named rather than merely somewhat specific.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
amElnagdy/guard-skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.