wordpress-pro

An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: api, performance, php, security, web.

What it does

Develops custom WordPress themes and plugins, creates and registers Gutenberg blocks and block patterns, configures WooCommerce stores, implements WordPress REST API endpoints, applies security hardening (nonces, sanitization, escaping, capability checks), and optimizes performance through caching and query tuning. Use when building WordPress themes, writing plugins, customizing Gutenberg blocks, extending WooCommerce, working with ACF, using the WordPress REST API, applying hooks and filters, or improving WordPress performance and security.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add Jeffallan/claude-skills --skill wordpress-pro

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/wordpress-pro ~/.claude/skills/wordpress-pro

Safety box score

Grade C, moderate risk: 42 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is for building WordPress themes, plugins, blocks, WooCommerce extensions, and related maintenance code. The main risks are that it teaches code which can reach outside the project tree, talk to remote services, and perform destructive site-level cleanup such as dropping tables or deleting backup files.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It includes shell execution examples like `npx @wordpress/create-block my-block --namespace my-plugin`, but no shipped executables or eval-style scripts.
Network access	2 (moderate)	It can implement outbound requests and phone-home behavior, e.g. `private string $update_url = 'https://example.com/api/plugin-updates/';` plus `wp_remote_get($this->update_url . 'info.json', ...)` in the update checker.
Filesystem reach	3 (high)	The references show destructive site/file operations outside the repo, including backup writes and deletes (`file_put_contents($filepath, $output)`, `unlink($filepath)`) and data removal such as `DROP TABLE IF EXISTS ...`.
Secrets & credentials	1 (low)	It handles sensitive values like an `api_key` setting and AJAX nonces, but does not read keychains, browser sessions, or password stores.
Privilege & persistence	1 (low)	It changes WordPress-level privileges and settings via hooks like `add_cap()`, `flush_rewrite_rules()`, and cron scheduling, but nothing requires OS sudo or service installation.
Instruction hijack surface	0 (none)	I found no instruction to ignore higher-level rules, follow hidden/remote prompt content, or conceal actions; the `wp_die()` permission checks are normal authorization code, not prompt injection.
Irreversible actions	2 (moderate)	It includes autonomous maintenance behaviors such as scheduled cleanup/backup jobs and automated update checks, which can modify site state without a separate human prompt.
Transparency	1 (low)	There are readable source files only, but some behavior depends on externally fetched content or registry packages such as `npx @wordpress/create-block` and remote update JSON.

Before installing

Read `references/plugin-architecture.md` and `references/performance-security.md` for `DROP TABLE`, `unlink()`, and scheduled cleanup paths.
If you will use the block scaffolding, run `npx @wordpress/create-block` in a disposable directory and pin the package version.
Inspect any generated plugin’s uninstall/backup code before activating it on a real site.
Verify any remote update/API endpoints (`wp_remote_get(...)`) are yours and acceptable to contact from the target site.

Rated 2026-10-20 by an automated review of 6 files from the skill's repository.

Source

Repository: Jeffallan/claude-skills (all skills from this repository)
Path: skills/wordpress-pro/SKILL.md
Branch: main
Updated: 2026-09-19

dotnet-core-expert — Use when building .NET 8 applications with minimal APIs, clean architecture, or cloud-native microservices. Invoke for Entity Framework Core.
java-architect — Use when building, configuring, or debugging enterprise Java applications with Spring Boot 3.x, microservices.
php-pro — Use when building PHP applications with modern PHP 8.3+ features, Laravel, or Symfony frameworks. Invokes strict typing, PHPStan level 9.
aws-auth — Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries.
django-storages-s3 — Use when configuring Django to store static and media files on AWS S3 with django-storages.
fullstack-guardian — Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level.