Implement WordPress plugins with explicit lifecycle behavior, permissions and maintainable integration points.
Editorial review checked 2026-10-29 against this instruction snapshot. Supporting scripts and runtime behavior remain outside this editorial review.
The workflow covers plugin discovery, architecture, hooks, settings, storage, scheduled work and release concerns. It emphasizes nonce checks, capabilities, sanitization and output escaping as separate responsibilities. This provides a useful implementation checklist when a small feature touches several WordPress interfaces and lifecycle stages.
Developers creating plugins or extending existing plugin behavior without replacing the project architecture.
Activation, uninstall and migration code can affect persistent user data. A nonce is not an authorization decision, and a successful administrator workflow does not demonstrate that lower-privilege or anonymous users are correctly restricted.
Targets WordPress 7.0+ (PHP 7.4.0+). Filesystem-based agent with bash + node. Some workflows require WP-CLI.
Inspect the pinned source snapshot and its supporting files first. The command selects this skill through the open-source skills CLI. Node.js and agent-specific setup may be required. Installation can download code. Catalog ingestion never executes skill instructions or install scripts.
npx skills add https://github.com/WordPress/agent-skills/tree/eff3785fc28c4380d172094518c66a6a997c95d4/skills/wp-plugin-development --skill wp-plugin-developmentReview pinned skill folder ↗ · CLI documentation ↗
After source review, use npx skills check and npx skills update to inspect and apply upstream updates. Re-check changed instructions before running them.
Static review only. This is not a security audit or a guarantee of safety.
SKILL.md text only; scripts, dependencies and runtime behavior not audited.
No configured text patterns matched. Unmatched or concealed behavior can still exist.
Allowed tools declaration: Unknown. Runtime permissions and network behavior: Unknown.
A temporary folder-copy check, not an agent installation or runtime safety verdict.
8 files copied and checksummed from this exact source snapshot. No package code or installation scripts were executed.
Inventory SHA-256: 5c9517fb0d0959f3128d20b28c0be4c2e07d79a4886b002d3fb97431442d00f4
Selected helper behavior only. Full agent compatibility and runtime safety remain unverified.
3 synthetic scenarios passed for skills/wp-plugin-development/scripts/detect_plugins.mjs, checked 2026-10-29. The container had no network, production data or credentials, and only read-only fixture and helper mounts.
Script SHA-256: 7df472957ab213161adad1111c2b69e3acc2d7235bae02d8e0f6fc14385efee5
25 synthetic helper scenarios across seven skills; not full agent evaluation, live WordPress, transitive dependency audit or safety certification.
Image: node@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914
75/100 · Metadata coverage 80% · Model 1.0
Scores summarize observable discovery signals. Popularity and repository activity apply to the whole repository. Unknown runtime safety earns no certification.
Bounded source inspection, not a runtime security audit. This inspection does not execute code.
1 text files inspected at this exact repository snapshot. 6 files outside the inspection budget or type allowlist. Dependencies were not installed or independently audited.
Absence of a pattern is not proof of safety. Permission needs and runtime behavior remain Unknown.
7df472957ab213161adad1111c2b69e3acc2d7235bae02d8e0f6fc14385efee5Locate the real plugin entrypoint and existing service boundaries. Implement the smallest feature, reuse established hooks and storage conventions, and specify what activation, deactivation and uninstall should each do before introducing irreversible cleanup behavior.
Test the feature with appropriate and insufficient capabilities, malformed inputs and repeated requests. Exercise installation and upgrades in a disposable site, inspect scheduled work and verify that removing the plugin preserves or deletes data only according to its documented policy.
Related by category; compare scope and dependencies before choosing an alternative.
Explore brainstorming as a development workflow from obra/superpowers. Compare its source, maintenance and review signals before choosing it for your agent.
Repository star change: +1264 over 41.38 hours. 2026-10-31
Explore receiving code review as a development workflow from obra/superpowers. Compare its source, maintenance and review signals before choosing it for your agent.
Repository star change: +1264 over 41.38 hours. 2026-10-31
Explore requesting code review as a development workflow from obra/superpowers. Compare its source, maintenance and review signals before choosing it for your agent.
Repository star change: +1264 over 41.38 hours. 2026-10-31
Plan reproducible WordPress Playground environments through explicit Blueprint configuration and bundled resources.
Repository star change: +3 over 40.37 hours. 2026-10-31
Choose a WordPress development workflow after identifying the repository and intended change.
Repository star change: +3 over 40.37 hours. 2026-10-31
Design WordPress abilities with explicit schemas, capability checks and controlled REST exposure.
Repository star change: +3 over 40.37 hours. 2026-10-31