Wp Phpstan

What it does

The source starts by discovering Composer scripts and configuration, then addresses WordPress stubs, type information and third-party APIs. It treats baselines as controlled migration aids. The included inspector suggests an entrypoint; it does not itself run PHPStan or prove that the project is free of type errors.

Best for

Plugin and theme maintainers introducing static analysis or improving an existing PHPStan configuration.

Tradeoffs and requirements

WordPress hooks and external plugin APIs can require additional stubs or precise version knowledge. Suppressing unresolved types broadly may hide genuine problems, while increasing a baseline can make a failing check appear successful without improving code.

Targets WordPress 7.0+ (PHP 7.4.0+). Requires Composer-based PHPStan.

Install from the source

Inspect the pinned source snapshot and its supporting files first. The command selects this skill through the open-source skills CLI. Node.js and agent-specific setup may be required. Installation can download code. Catalog ingestion never executes skill instructions or install scripts.

npx skills add https://github.com/WordPress/agent-skills/tree/eff3785fc28c4380d172094518c66a6a997c95d4/skills/wp-phpstan --skill wp-phpstan

Review pinned skill folder ↗ · CLI documentation ↗

After source review, use npx skills check and npx skills update to inspect and apply upstream updates. Re-check changed instructions before running them.

Safety & review signals

Static review only. This is not a security audit or a guarantee of safety.

SKILL.md text only; scripts, dependencies and runtime behavior not audited.

No configured text patterns matched. Unmatched or concealed behavior can still exist.

Allowed tools declaration: Unknown. Runtime permissions and network behavior: Unknown.

Offline package integrity

A temporary folder-copy check, not an agent installation or runtime safety verdict.

5 files copied and checksummed from this exact source snapshot. No package code or installation scripts were executed.

Inventory SHA-256: ccfcfcd56ae16e5fb3daddedf0d2844c7f4ebd418177ab9f3b8a29ea9e865fbb

Isolated helper checks

Selected helper behavior only. Full agent compatibility and runtime safety remain unverified.

3 synthetic scenarios passed for skills/wp-phpstan/scripts/phpstan_inspect.mjs, checked 2026-10-29. The container had no network, production data or credentials, and only read-only fixture and helper mounts.

Script SHA-256: 035a73b0d47de4464bbcbf85f12bafbc432496f5cf393da3ca6071eeee44bb5d

AI Craft Pad Skill Score

75/100 · Metadata coverage 80% · Model 1.0

Scores summarize observable discovery signals. Popularity and repository activity apply to the whole repository. Unknown runtime safety earns no certification.

Documentation

100/100

100

Maintenance

100/100

100

License Clarity

0/100

0

Repository Health

85/100

85

Compatibility Evidence

80/100

80

Popularity

61/100

61

Originality

80/100

80

Static Safety

60/100

60

Supporting-file static inspection

Bounded source inspection, not a runtime security audit. This inspection does not execute code.

1 text files inspected at this exact repository snapshot. 3 files outside the inspection budget or type allowlist. Dependencies were not installed or independently audited.

• Dependency Declaration: 1 file — inspect context before use.

Absence of a pattern is not proof of safety. Permission needs and runtime behavior remain Unknown.

Suggested workflow

Inspect the current configuration and Composer scripts, load appropriate WordPress types and establish the existing error set. Fix concrete typing issues incrementally, adding narrow third-party definitions only when the actual dependency contract is known.

How to judge the result

Run the established analysis command and inspect the resulting diff in errors and baseline entries. Check that newly added files are included, existing checks still execute and no broad ignore rule merely conceals the change under review.