Skills ZICQ category：Security wordpress-pro

Wordpress Pro

Develops custom WordPress themes and plugins, creates and registers Gutenberg blocks and block patterns, configures WooCommerce stores, implements WordPress REST API endpoints, applies security hardening (nonces, sanitization, escaping, capability checks), and optimizes performance through caching and query tuning. Use when building WordPress themes, writing plugins, customizing Gutenberg blocks, extending WooCommerce, working with ACF, using the WordPress REST API, applying hooks and filters, or improving WordPress performance and security.

9432 installs

Official URL：skills.sh

What this skill does

Intro in this page language first. The official description stays in its original wording; we do not rewrite SKILL.md.

What it does

When to use it

building WordPress themes, writing plugins, customizing Gutenberg blocks, extending WooCommerce, working with ACF, using the WordPress REST API, applying hooks and filters, or improving WordPress performance and security

How agents load it

Per Agent Skills progressive disclosure: name and description load at startup (~100 tokens); the full SKILL.md body loads when the skill activates; scripts/, references/, and assets/ load only as needed. This file's sections: WordPress Pro; Core Workflow; Reference Guide; Key Implementation Patterns; Nonce Verification (form submissions); Sanitization & Escaping. It includes spec-recommended sections: step-by-step instructions.

File analysis

File analysis: besides SKILL.md, the body references references/theme-development.md, references/plugin-architecture.md, references/gutenberg-blocks.md, references/hooks-filters.md, references/performance-security.md, assets/js/main.js. Those resources load on demand.

WordPress ProCore WorkflowReference GuideKey Implementation PatternsNonce Verification (form submissions)Sanitization & EscapingEnqueuing Scripts & StylesPrepared Database QueriesCapability ChecksConstraintsMUST DOMUST NOT DO

· License：MIT

Source category：skills.sh agent-skill

Sources & links

Market sources：skills.sh

Full package on GitHub

OSS Skill ranking

SKILL.md & Agent activation

Official spec ↗

name: wordpress-pro
description: Develops custom WordPress themes and plugins, creates and registers Gutenberg blocks and block patterns, configures WooCommerce stores, implements WordPress REST API endpoints, applies security hardening (nonces, sanitization, escaping, capability checks), and optimizes performance through caching and query tuning. Use when building WordPress themes, writing plugins, customizing Gutenberg blocks, extending WooCommerce, working with ACF, using the WordPress REST API, applying hooks and filters, or improving WordPress performance and security.
License: MIT

DiscoverThe client exposes names and descriptions to the agent.
ActivateYour request or the task context selects the skill and loads its instructions.
Load resourcesReferenced scripts, documentation and assets are used when needed.

Files referenced by the instructions · 7

references/theme-development.md
references/plugin-architecture.md
references/gutenberg-blocks.md
references/hooks-filters.md
references/performance-security.md
assets/js/main.js
scripts/styles

These paths are extracted from the text. Check the upstream package to verify the files exist.

Invocation syntax and available tools depend on your Agent client. Client integration guide ↗

Install this skill

Skills CLI ↗

Choose the target agent and installation scope, keep referenced package files, then verify the skill appears in the client's catalog.

This skill references supporting files. Retrieve the complete directory from the source; copying SKILL.md alone may leave missing dependencies.

Ask your Agent to install

Copy these instructions to a compatible agent and confirm the target directory matches your client.

Install the agent skill "wordpress-pro" into my project. The full SKILL.md and official description are at https://zicq.com/en/skills/skl-36f7fd986805a0f4-Wordpress-Pro.html
Save it as .cursor/skills/wordpress-pro/SKILL.md or .claude/skills/wordpress-pro/SKILL.md and keep the frontmatter name and description exactly as-is.
This skill also ships scripts/, references/, or assets/ — fetch the whole folder from https://github.com/jeffallan/claude-skills instead of creating only a SKILL.md.

Full package on GitHub ↗

Install from the terminal · Skills CLI

Requires Node.js and npx. First inspect the repository's skill list to confirm the name.

npx skills add 'https://github.com/jeffallan/claude-skills' --list

Target agent Installation scope

npx skills add 'https://github.com/jeffallan/claude-skills' --skill 'wordpress-pro'

The CLI lets you choose the agent interactively. The default scope is the project; use -g for user scope. Confirm package availability with the discovery command, then use npx skills list to inspect installed skills.

SKILL.md source Copy freely; the source file is unchanged

# WordPress Pro

Expert WordPress developer specializing in custom themes, plugins, Gutenberg blocks, WooCommerce, and WordPress performance optimization.

## Core Workflow

1. **Analyze requirements** — Understand WordPress context, existing setup, and goals.
2. **Design architecture** — Plan theme/plugin structure, hooks, and data flow.
3. **Implement** — Build using WordPress coding standards and security best practices.
4. **Validate** — Run `phpcs --standard=WordPress` to catch WPCS violations; verify nonce handling and capability checks manually.
5. **Optimize** — Apply transient/object caching, query optimization, and asset enqueuing.
6. **Test & secure** — Confirm sanitization/escaping on all I/O, test across target WordPress versions, and run a security audit checklist.

## Reference Guide

Load detailed guidance based on context:

| Topic | Reference | Load When |
|-------|-----------|-----------|
| Theme Development | `references/theme-development.md` | Templates, hierarchy, child themes, FSE |
| Plugin Architecture | `references/plugin-architecture.md` | Structure, activation, settings API, updates |
| Gutenberg Blocks | `references/gutenberg-blocks.md` | Block dev, patterns, FSE, dynamic blocks |
| Hooks & Filters | `references/hooks-filters.md` | Actions, filters, custom hooks, priorities |
| Performance & Security | `references/performance-security.md` | Caching, optimization, hardening, backups |

## Key Implementation Patterns

### Nonce Verification (form submissions)
```php
// Output nonce field in form
wp_nonce_field( 'my_action', 'my_nonce' );

// Verify on submission — bail early if invalid
if ( ! isset( $_POST['my_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['my_nonce'] ) ), 'my_action' ) ) {
    wp_die( esc_html__( 'Security check failed.', 'my-textdomain' ) );
}
```

### Sanitization & Escaping
```php
// Sanitize input (store)
$title   = sanitize_text_field( wp_unslash( $_POST['title'] ?? '' ) );
$content = wp_kses_post( wp_unslash( $_POST['content'] ?? '' ) );
$url     = esc_url_raw( wp_unslash( $_POST['url'] ?? '' ) );

// Escape output (display)
echo esc_html( $title );
echo wp_kses_post( $content );
echo '<a href="' . esc_url( $url ) . '">' . esc_html__( 'Link', 'my-textdomain' ) . '</a>';
```

### Enqueuing Scripts & Styles
```php
add_action( 'wp_enqueue_scripts', 'my_theme_assets' );
function my_theme_assets(): void {
    wp_enqueue_style(
        'my-theme-style',
        get_stylesheet_uri(),
        [],
        wp_get_theme()->get( 'Version' )
    );
    wp_enqueue_script(
        'my-theme-script',
        get_template_directory_uri() . '/assets/js/main.js',
        [ 'jquery' ],
        '1.0.0',
        true // load in footer
    );
    // Pass server data to JS safely
    wp_localize_script( 'my-theme-script', 'MyTheme', [
        'ajaxUrl' => admin_url( 'admin-ajax.php' ),
        'nonce'   => wp_create_nonce( 'my_ajax_nonce' ),
    ] );
}
```

### Prepared Database Queries
```php
global $wpdb;
$results = $wpdb->get_results(
    $wpdb->prepare(
        "SELECT * FROM {$wpdb->prefix}my_table WHERE user_id = %d AND status = %s",
        absint( $user_id ),
        sanitize_text_field( $status )
    )
);
```

### Capability Checks
```php
// Always check capabilities before sensitive operations
if ( ! current_user_can( 'manage_options' ) ) {
    wp_die( esc_html__( 'You do not have permission to do this.', 'my-textdomain' ) );
}
```

## Constraints

### MUST DO
- Follow WordPress Coding Standards (WPCS); validate with `phpcs --standard=WordPress`
- Use nonces for all form submissions and AJAX requests
- Sanitize all user inputs with appropriate functions (`sanitize_text_field`, `wp_kses_post`, etc.)
- Escape all outputs (`esc_html`, `esc_url`, `esc_attr`, `wp_kses_post`)
- Use prepared statements for all database queries (`$wpdb->prepare`)
- Implement proper capability checks before privileged operations
- Enqueue scripts/styles via `wp_enqueue_scripts` / `admin_enqueue_scripts` hooks
- Use WordPress hooks instead of modifying core
- Write translatable strings with text domains (`__()`, `esc_html__()`, etc.)
- Test across target WordPress versions

### MUST NOT DO
- Modify WordPress core files
- Use PHP short tags or deprecated functions
- Trust user input without sanitization
- Output data without escaping
- Hardcode database table names (use `$wpdb->prefix`)
- Skip capability checks in admin functions
- Ignore SQL injection vectors
- Bundle unnecessary libraries when WordPress APIs suffice
- Allow unsafe file upload handling
- Skip internationalization (i18n)

## Output Templates

When implementing WordPress features, provide:
1. Main plugin/theme file with proper headers
2. Relevant template files or block code
3. Functions with proper WordPress hooks
4. Security implementations (nonces, sanitization, escaping)
5. Brief explanation of WordPress-specific patterns used

## Knowledge Reference

WordPress 6.4+, PHP 8.1+, Gutenberg, WooCommerce, ACF, REST API, WP-CLI, block development, theme customizer, widget API, shortcode API, transients, object caching, query optimization, security hardening, WPCS

Maintained by [@jeffallan](https://github.com/jeffallan), Principal Consultant at [Synergetic Solutions](https://synergetic.solutions)

[Documentation](https://jeffallan.github.io/claude-skills/skills/platform/wordpress-pro/)

Readable layout

--- name: wordpress-pro description: Develops custom WordPress themes and plugins, creates and registers Gutenberg blocks and block patterns, configures WooCommerce stores, implements WordPress REST API endpoints, applies security hardening (nonces, sanitization, escaping, capability checks), and optimizes performance through caching and query tuning. Use when building WordPress themes, writing plugins, customizing Gutenberg blocks, extending WooCommerce, working with ACF, using the WordPress REST API, applying hooks and filters, or improving WordPress performance and security. license: MIT metadata: author: https://github.com/Jeffallan company: https://synergetic.solutions version: "1.1.0" domain: platform triggers: WordPress, WooCommerce, Gutenberg, WordPress theme, WordPress plugin, custom blocks, ACF, WordPress REST API, hooks, filters, WordPress performance, WordPress security role: expert scope: implementation output-format: code related-skills: php-pro, laravel-specialist, fullstack-guardian, security-reviewer --- # WordPress Pro Expert WordPress developer specializing in custom themes, plugins, Gutenberg blocks, WooCommerce, and WordPress performance optimization. ## Core Workflow 1. **Analyze requirements** — Understand WordPress context, existing setup, and goals. 2. **Design architecture** — Plan theme/plugin structure, hooks, and data flow. 3. **Implement** — Build using WordPress coding standards and security best practices. 4. **Validate** — Run `phpcs --standard=WordPress` to catch WPCS violations; verify nonce handling and capability checks manually. 5. **Optimize** — Apply transient/object caching, query optimization, and asset enqueuing. 6. **Test & secure** — Confirm sanitization/escaping on all I/O, test across target WordPress versions, and run a security audit checklist. ## Reference Guide Load detailed guidance based on context: | Topic | Reference | Load When | |-------|-----------|-----------| | Theme Development | `references/theme-development.md` | Templates, hierarchy, child themes, FSE | | Plugin Architecture | `references/plugin-architecture.md` | Structure, activation, settings API, updates | | Gutenberg Blocks | `references/gutenberg-blocks.md` | Block dev, patterns, FSE, dynamic blocks | | Hooks & Filters | `references/hooks-filters.md` | Actions, filters, custom hooks, priorities | | Performance & Security | `references/performance-security.md` | Caching, optimization, hardening, backups | ## Key Implementation Patterns ### Nonce Verification (form submissions) ```php // Output nonce field in form wp_nonce_field( 'my_action', 'my_nonce' ); // Verify on submission — bail early if invalid if ( ! isset( $_POST['my_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['my_nonce'] ) ), 'my_action' ) ) { wp_die( esc_html__( 'Security check failed.', 'my-textdomain' ) ); } ``` ### Sanitization & Escaping ```php // Sanitize input (store) $title = sanitize_text_field( wp_unslash( $_POST['title'] ?? '' ) ); $content = wp_kses_post( wp_unslash( $_POST['content'] ?? '' ) ); $url = esc_url_raw( wp_unslash( $_POST['url'] ?? '' ) ); // Escape output (display) echo esc_html( $title ); echo wp_kses_post( $content ); echo '' . esc_html__( 'Link', 'my-textdomain' ) . ''; ``` ### Enqueuing Scripts & Styles ```php add_action( 'wp_enqueue_scripts', 'my_theme_assets' ); function my_theme_assets(): void { wp_enqueue_style( 'my-theme-style', get_stylesheet_uri(), [], wp_get_theme()->get( 'Version' ) ); wp_enqueue_script( 'my-theme-script', get_template_directory_uri() . '/assets/js/main.js', [ 'jquery' ], '1.0.0', true // load in footer ); // Pass server data to JS safely wp_localize_script( 'my-theme-script', 'MyTheme', [ 'ajaxUrl' => admin_url( 'admin-ajax.php' ), 'nonce' => wp_create_nonce( 'my_ajax_nonce' ), ] ); } ``` ### Prepared Database Queries ```php global $wpdb; $results = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}my_table WHERE user_id = %d AND status = %s", absint( $user_id ), sanitize_text_field( $status ) ) ); ``` ### Capability Checks ```php // Always check capabilities before sensitive operations if ( ! current_user_can( 'manage_options' ) ) { wp_die( esc_html__( 'You do not have permission to do this.', 'my-textdomain' ) ); } ``` ## Constraints ### MUST DO - Follow WordPress Coding Standards (WPCS); validate with `phpcs --standard=WordPress` - Use nonces for all form submissions and AJAX requests - Sanitize all user inputs with appropriate functions (`sanitize_text_field`, `wp_kses_post`, etc.) - Escape all outputs (`esc_html`, `esc_url`, `esc_attr`, `wp_kses_post`) - Use prepared statements for all database queries (`$wpdb->prepare`) - Implement proper capability checks before privileged operations - Enqueue scripts/styles via `wp_enqueue_scripts` / `admin_enqueue_scripts` hooks - Use WordPress hooks instead of modifying core - Write translatable strings with text domains (`__()`, `esc_html__()`, etc.) - Test across target WordPress versions ### MUST NOT DO - Modify WordPress core files - Use PHP short tags or deprecated functions - Trust user input without sanitization - Output data without escaping - Hardcode database table names (use `$wpdb->prefix`) - Skip capability checks in admin functions - Ignore SQL injection vectors - Bundle unnecessary libraries when WordPress APIs suffice - Allow unsafe file upload handling - Skip internationalization (i18n) ## Output Templates When implementing WordPress features, provide: 1. Main plugin/theme file with proper headers 2. Relevant template files or block code 3. Functions with proper WordPress hooks 4. Security implementations (nonces, sanitization, escaping) 5. Brief explanation of WordPress-specific patterns used ## Knowledge Reference WordPress 6.4+, PHP 8.1+, Gutenberg, WooCommerce, ACF, REST API, WP-CLI, block development, theme customizer, widget API, shortcode API, transients, object caching, query optimization, security hardening, WPCS Maintained by [@jeffallan](https://github.com/jeffallan), Principal Consultant at [Synergetic Solutions](https://synergetic.solutions) [Documentation](https://jeffallan.github.io/claude-skills/skills/platform/wordpress-pro/)

Related skills

Security