wp-plugin-skill skillA
wp-plugin-skill is agent-read markdown (skill) from ararai1991/wp-plugin-skill: Build, review, and ship production-grade WordPress plugins — architecture, hooks, admin pages, settings, custom post types, taxonomies, metadata, users and capabilities, AJAX/REST, HTTP API, cron, shortcodes, blocks, the Abilities API and AI Client, internationalization, privacy, testing, and security hardening. Use when writing any WordPress plugin PHP code, scaffolding a new plugin, adding plugin features, reviewing plugin code for bugs or vulnerabilities, handling $_GET/$_POST, registering AJ.
Indexed from public GitHub and served as immutable, content-addressed versions. Install it pinned to an exact SHA-256 with the mdr CLI, and every file is verified against the hash recorded here before it reaches your agent. The deterministic audit below grades the latest version, and the same file always earns the same grade.
What the file says
# WordPress Plugin Development ## Overview This skill covers building WordPress plugins that are correct, secure, maintainable, and directory-ready. It follows the structure of the official [Plugin Handbook](https://developer.wordpress.org/plugins/), with each chapter's practical content in `references/`. Two rules govern everything else: **1. Every entry point needs three gates.** Nearly every plugin CVE is a missing gate, not an exotic exploit. ``` Gate 1 AUTHENTICATION Is this a logged-in user? is_user_logged_in() Gate 2 AUTHORIZATION May THIS user do THIS thing? current_user_can( 'cap' ) Gate 3 INTENT Did they mean to, right now? check_admin_referer() Then INPUT Sanitize + validate every request value Then OUTPUT Escape at the point of printing, per context ``` A nonce without a capability check is not security — it only proves the request came from your form, not that the user is allowed. A capability check without a nonce leaves you open to CSRF. You need both. …
Read the whole file at its exact version.
How to install
mdr add ararai1991/wp-plugin-skill/wp-plugin-skill@v1.1.0mdr add ararai1991/wp-plugin-skill/wp-plugin-skill@sha256:6664b30db69f9794Pin to a label to follow the author's releases, or to a sha256 to freeze the exact bytes forever. Either way the resolved hash is written to mdr.lock, and mdr install reproduces it on any machine.
[](https://markdownregistry.com/a/art_p6wpdxhhhx5rrzxg)
1 badge views in 30 days
Versions
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v1.1.0 latest | 2026-09-23 | 814f9f0 | 15,243 B | A | view · diff |
| git:20260915.c8c111c | 2026-09-15 | c8c111c | 13,128 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (15243 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
ararai1991/wp-plugin-skill · 3 stars · license MIT · pushed 2026-09-23 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_p6wpdxhhhx5rrzxg GET https://markdownregistry.com/api/v1/resolve?ref=ararai1991/wp-plugin-skill/wp-plugin-skill GET https://markdownregistry.com/api/v1/blob/6664b30db69f9794b3d9a106afabe405436124d4d8d4650bda6ac26ffe7b9244
Your agent does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.