Search skills/

Agent Skills for WordPress agent skills

The WordPress project's skill pack for coding agents: 19 skills covering blocks, block themes, plugins, REST, Abilities API, WP-CLI, Playground and performance.

WordPress/agent-skills 19 skills Code review & qualityBackend & databases

with caveats

Detailed, well-organized WordPress procedures from the official organization, but the license is not declared in a standard form and the README calls this an AI-generated v1.

check first: relies on an outside CLI · installs packages → security details

Depth
4/5
Last update
6 days ago
Installs
—
Stars
2.3K
Forks
341
License
Unclear

What Agent Skills for WordPress does

This pack gives a coding agent written procedures for WordPress work so it stops falling back on pre-Gutenberg patterns. A wordpress-router skill runs first. It calls a triage script (detect_wp_project.mjs) to classify the repo as a plugin, classic theme, block theme, core checkout or full site, notes the tooling and tests present, and then sends the agent to the matching domain skill using a decision tree in its references folder.

The domain skills cover Gutenberg block development (block.json, attributes, deprecations), block themes and theme.json, patterns, plugin architecture and security, the REST API, the Interactivity API, the Abilities API (with separate audit and verify skills), WP-CLI and multisite operations, performance profiling, PHPStan setup, Playground and Blueprint JSON, @wordpress/env, the WordPress Design System, and the Plugin Directory guidelines. Each SKILL.md follows the same layout: when to use it, required inputs, procedure, verification and failure modes. Most skills have a references/ folder with deeper docs, and a few include small Node helper scripts such as list_blocks.mjs and perf_inspect.mjs. The README says GPT-5.2 Codex generated the skills from official documentation and that WordPress contributors then reviewed and edited them.

Good for

  • Building Gutenberg blocks or block themes with an agent
  • Plugin work that needs current security and directory-guideline checks
  • Adding or auditing Abilities API registrations
  • Setting up local environments with wp-env, Playground or Blueprints

Not for

  • Sites pinned to old WordPress versions, since the skills target WordPress 7.0+
  • Non-WordPress PHP or JavaScript projects

What's inside depth 4/5

19 skills averaging about 6 KB each, most with several reference docs, a handful of Node helper scripts, plus 52 eval files and CI in the repo.

Skills
19
Reference docs
88
Scripts
7
Tests / evals
52
Templates
0
Avg SKILL.md
6 KB

Counted from the repository file tree. How we score depth.

Dependencies and costs

  • Node.js and bash in the agent environment (the router runs a Node triage script)
  • WP-CLI for some workflows
  • Optional: WordPress Playground CLI or a browser, @wordpress/env for the wp-env skill

Security review

Security: Check first

This is a collection of WordPress development skills, mostly documentation plus local Node scripts that inspect your repo and print JSON. Some workflows run or install external tools (WP-CLI, @wordpress/env, Playground CLI via npx ...@latest), and the optional installer can write skills into global agent folders in your home directory. Two of the listed scripts (project triage and WP-CLI inspect) were not available for review, and the repo's maintenance scripts call WordPress, GitHub and Anthropic APIs from CI.

Worth knowing

  • Relies on a CLI or package we could not reviewRuns the WP-CLI wp binary (core, option, doctor, profile commands) against the WordPress install given by --path/--url.skills/wp-performance/scripts/perf_inspect.mjs:32
  • Relies on a CLI or package we could not reviewwp-env and Playground skills rely on the @wordpress/env and @wp-playground/cli npm packages, whose source is not in this repo.skills/wp-env/SKILL.md
  • Installs packages or toolsInstructs a global install of @wordpress/env with npm -g install; perf_inspect also suggests wp package install for the doctor and profile commands.skills/wp-env/SKILL.md:42
  • Runs remote code at an unpinned versionThe verification step runs npx @wp-playground/cli@latest server --auto-mount.skills/wp-patterns/SKILL.md
  • Changes files outside your projectWith --global or the *-global targets, it copies skills into ~/.claude/skills, ~/.cursor/skills or ~/.gemini/antigravity/skills, and replaces same-named skill folders by default.shared/scripts/skillpack-install.mjs
  • Makes network requestsThis maintainer script fetches version data from api.wordpress.org, api.github.com and developer.wordpress.org and writes it to shared/references.shared/scripts/update-upstream-indices.mjs:41
  • Makes network requestsThis CI maintenance script sends SKILL.md and reference content to the Anthropic API using ANTHROPIC_API_KEY and writes the model's suggested content back into skill files.shared/scripts/ai-generate-updates.mjs

What we checked

The repository (193 files) on Nov 1, 2026. Not a full review: we read 11 of 13 code files; it relies on code outside the repository: skills/wp-project-triage/scripts/detect_wp_project.mjs (listed code file; full text not provided); skills/wp-wpcli-and-ops/scripts/wpcli_inspect.mjs (listed code file; full text not provided); WP-CLI (`wp` binary) and its doctor/profile packages.

NVIDIA SkillSpector static scan: 84 pattern hits (MCP Rug Pull 30, Agent Snooping 16, Data Exfiltration 11, Excessive Agency 10, Prompt Injection 8, Tool Misuse 7). The HIGH 'hidden instructions' hits are WordPress block-grammar HTML comments (<!-- wp:... -->) in pattern references. The rm -rf hit is CI cleanup of a /tmp test folder, and 'Always respond' is the JSON-format system prompt in the maintenance script. '--allow-root' is a WP-CLI flag that is passed only if the user supplies it, and the skill-enumeration and 'npx skills' hits are documentation paths and install instructions.

A review, not a certification. Skills change after we check them — read the files before installing.

License

GitHub reports the license as NOASSERTION, meaning it could not match a standard license. Check the repo's license section before commercial reuse or redistribution.

Can it run unattended?

Not really. These are domain procedures and references the agent consults during interactive WordPress work; they define no long-running loop or resumable state of their own.

Alternatives to Agent Skills for WordPress

Vercel Agent Skills

vercel-labs/agent-skills

Vercel's official 9-skill pack: React and Next.js performance rules, composition patterns, UI and writing review, React Native, deploy and cost audit.

recommended Security: Broad access depth3/5

Cloudflare Skills

cloudflare/skills

Cloudflare's official 19-skill pack for building on Workers, Durable Objects, the Agents SDK, Cloudflare One and more, with an optional bundled MCP server.

recommended Security: Check first depth4/5

Full-Stack Dev Skills (Jeffallan)

Jeffallan/claude-skills

67 role-based developer skills for languages, frameworks, DevOps and security, each with reference files, plus 9 Jira/Confluence workflow commands.

recommended Security: Check first depth3/5

jezweb claude-skills

jezweb/claude-skills

A marketplace of Claude Code plugins for web builders: Cloudflare apps, design assets, frontend, dev tools, writing, Shopify and WordPress.

with caveats Security: Broad access depth3/5

FAQ

What is WordPress/agent-skills?

It is a set of 19 agent skills published by the WordPress organization on GitHub. The skills teach coding agents current WordPress practice for blocks, block themes, plugins, REST and Abilities APIs, WP-CLI, performance, PHPStan, Playground and wp-env. A router skill classifies your repo first and points the agent to the right skill.

How do I install the WordPress agent skills?

Run npx skills add WordPress/agent-skills --skill wp-plugin-development for one skill, or list several names after --skill. Use --list to see every skill. The installer lets you choose project scope (for example .claude/skills/ or .cursor/skills/, which you can commit) or global scope in your home directory.

Which WordPress versions do these skills target?

The SKILL.md compatibility fields say WordPress 7.0+ and PHP 7.4.0+. The Abilities API skill notes that projects targeting WordPress below 6.9 may need the Abilities API plugin or package instead of relying on core.

Were these skills written by AI?

Yes, partly. The README says GPT-5.2 Codex generated them from official Gutenberg and WordPress documentation, and WordPress contributors then reviewed and edited them and tested them with AI assistants. The maintainers describe this as v1 and expect community fixes.

Is WordPress/agent-skills safe to install?

We found no credential reads, obfuscated code or hidden network calls in the skills. The scanner flags are documentation patterns such as block markup comments and a /tmp cleanup step in CI. The few helper scripts are small Node utilities for detection and inspection.

Curated by , AI enthusiast. Reviews are written by AI reviewers under our rubric and checked against the repository files.

Sources: GitHub repository (stars, license, file tree, last push Oct 26, 2026). Review based on the README and SKILL.md files as published.