WordPress-Security-Skills

In the author's own words, from each skill's SKILL.md.

• ai-llm-integration-security

  Use when building or reviewing WordPress plugin or theme features that call an LLM or AI provider: chatbots, content generation, summarization, AI search/RAG over site content, agents that call tools, Abilities API abilities, or MCP exposure. Treats model output and all context as untrusted, binds every tool action to the human user's capabilities, confirms destructive actions server-side, keeps…

  skills/ai-llm-integration-security/SKILL.md on GitHub (opens in a new tab)

• ajax-security

  Use when registering or handling WordPress AJAX over admin-ajax.php - wp_ajax_{action} / wp_ajax_nopriv_{action} hooks, JavaScript that posts to admin_url('admin-ajax.php'), or wp.apiFetch / fetch calls to custom actions. Verifies the nonce with check_ajax_referer, gates the action with current_user_can, unslashes and sanitizes every field, and replies with wp_send_json_success / wp_send_json_err…

  skills/ajax-security/SKILL.md on GitHub (opens in a new tab)

• authentication-session-security

  Use when code logs users in or out, sets or clears auth cookies, manages session tokens, throttles failed logins, or builds a custom login form in WordPress. Enforces wp_signon() and core session primitives over hand-rolled credential checks, adds brute-force throttling via the wp_authenticate_user filter keyed on username + IP, destroys sessions after password or role changes, makes login error…

  skills/authentication-session-security/SKILL.md on GitHub (opens in a new tab)

• capability-permission-checks

  Use when adding admin pages, menu items, AJAX/REST handlers, action links, or any code that performs a privileged operation in WordPress. Gates actions with current_user_can() using the correct capability (not roles), including per-object checks like edit_post, and pairs the check with a nonce. Prevents privilege escalation and broken access control. Apply proactively to every privileged code pat…

  skills/capability-permission-checks/SKILL.md on GitHub (opens in a new tab)

• cron-background-job-security

  Use when scheduling WordPress cron events with wp_schedule_event / wp_schedule_single_event or writing the callback that runs on a cron hook. Treats cron callbacks as running without a logged-in user, re-checks authorization against stored context rather than current_user_can, keeps secrets out of cron URLs, and validates any stored input the job consumes. Prevents unauthenticated privileged acti…

  skills/cron-background-job-security/SKILL.md on GitHub (opens in a new tab)

• dependency-supply-chain-security

  Use when a plugin or theme bundles a third-party PHP or JavaScript library, enqueues an asset from a CDN, fetches or executes code at runtime, manages dependencies with Composer, or prepares the distributable zip. Covers core-handle-first enqueuing, dependency vetting with composer audit, lockfile pinning, export-ignore artifact hygiene, Subresource Integrity for CDN assets via script_loader_tag,…

  skills/dependency-supply-chain-security/SKILL.md on GitHub (opens in a new tab)

• file-upload-security

  Use when a WordPress plugin or theme accepts file uploads, processes $_FILES, saves user-provided files, or generates file paths from input. Uses wp_handle_upload and wp_check_filetype_and_ext with a MIME/extension allowlist, blocks executable types, and prevents path traversal. Prevents arbitrary file upload and RCE. Apply proactively to any upload or file-writing code path.

  skills/file-upload-security/SKILL.md on GitHub (opens in a new tab)

• filesystem-security

  Use when reading, writing, including, or deleting files from paths that include user input - include / require, readfile, unlink, file_get_contents, or the WP_Filesystem API. Validates paths with validate_file, normalizes with wp_normalize_path, confines operations to an allowed base directory, and uses wp_delete_file / WP_Filesystem. Prevents path traversal, local file inclusion, and arbitrary f…

  skills/filesystem-security/SKILL.md on GitHub (opens in a new tab)

• gutenberg-block-editor-security

  Use when building dynamic blocks or block-editor features - a render_callback, server-side rendered blocks via ServerSideRender, REST-backed block data, or register_rest_field for the editor. Sanitizes block attributes per type, escapes server render output, sets a real permission_callback on editor REST surfaces, and handles RichText content with wp_kses. Prevents stored XSS and broken access co…

  skills/gutenberg-block-editor-security/SKILL.md on GitHub (opens in a new tab)

• http-api-ssrf-prevention

  Use when a plugin or theme makes outbound HTTP requests with the WordPress HTTP API - wp_remote_get, wp_remote_post, wp_remote_request - especially when any part of the URL comes from user input, options, or webhooks. Uses wp_safe_remote_* with wp_http_validate_url, allowlists hosts, blocks internal and metadata addresses, and checks is_wp_error plus the response code. Prevents server-side reques…

  skills/http-api-ssrf-prevention/SKILL.md on GitHub (opens in a new tab)

• input-sanitization-validation

  Use when reading any external input in WordPress — $_GET, $_POST, $_REQUEST, $_COOKIE, REST params, shortcode/block attributes, option/meta values, or remote API responses. Unslashes then sanitizes to the correct type (sanitize_text_field, sanitize_email, absint, sanitize_key, wp_kses_post, esc_url_raw) and validates values against expected sets. Apply proactively before storing or using any untr…

  skills/input-sanitization-validation/SKILL.md on GitHub (opens in a new tab)

• multisite-security

  Use when writing code that runs on a WordPress multisite network - switch_to_blog, network admin pages, get_sites, or capabilities that differ between site and network scope. Uses manage_network / manage_network_options and is_super_admin correctly, restores context with restore_current_blog, isolates per-site data, and never trusts a blog id from input. Prevents cross-site data leakage and netwo…

  skills/multisite-security/SKILL.md on GitHub (opens in a new tab)

• nonces-csrf-protection

  Use when handling any form submission, AJAX request, admin-post action, settings page, link that triggers an action, or any other user-initiated request in a WordPress plugin or theme. Generates nonces with wp_nonce_field / wp_create_nonce and verifies them with check_admin_referer, check_ajax_referer, or wp_verify_nonce, always paired with a capability check, to prevent CSRF. Apply proactively w…

  skills/nonces-csrf-protection/SKILL.md on GitHub (opens in a new tab)

• object-injection-deserialization

  Use when code calls unserialize, maybe_unserialize, or stores serialized PHP in options, meta, or transients from untrusted input. Avoids unserialize on attacker-controlled data, prefers json_encode / json_decode, and when unserialize is unavoidable passes ['allowed_classes' => false]. Prevents PHP object injection and POP-chain remote code execution.

  skills/object-injection-deserialization/SKILL.md on GitHub (opens in a new tab)

• output-escaping

  Use when echoing or printing any dynamic value in WordPress PHP or templates — into HTML, attributes, URLs, inline JavaScript, or textareas. Escapes at the point of output with esc_html, esc_attr, esc_url, esc_js, esc_textarea, or wp_kses_post, including the i18n variants (esc_html__, esc_attr_e). Prevents stored and reflected XSS. Apply proactively to every echoed variable, even data from the da…

  skills/output-escaping/SKILL.md on GitHub (opens in a new tab)

• rest-api-security

  Use when registering WordPress REST API routes with register_rest_route or building custom endpoints. Sets a real permission_callback (never __return_true for writes), defines args with sanitize_callback and validate_callback, enforces capabilities and per-object checks, and escapes any HTML in responses. Prevents broken access control and injection via the REST surface. Apply proactively to ever…

  skills/rest-api-security/SKILL.md on GitHub (opens in a new tab)

• secrets-credentials-management

  Use when handling passwords, API keys, tokens, or third-party credentials in a WordPress plugin or theme. Hashes passwords with wp_hash_password / wp_check_password, generates tokens with wp_generate_password, keeps secrets out of code and the database in plaintext, and uses Application Passwords for API auth. Prevents credential leakage and insecure storage.

  skills/secrets-credentials-management/SKILL.md on GitHub (opens in a new tab)

• secure-plugin-development

  Use when starting a new WordPress plugin or theme, scaffolding a plugin file, wiring hooks, or adding any feature that handles requests, options, or output. Establishes the secure-by-default baseline — ABSPATH guard, the capability + nonce + sanitize + escape flow, prepared queries, and safe defaults — and routes to the focused security skills for each concern. Apply proactively at the start of a…

  skills/secure-plugin-development/SKILL.md on GitHub (opens in a new tab)

• security-auditing-code-review

  Use when auditing or code-reviewing an existing WordPress plugin or theme for security issues, triaging a vulnerability report, or hardening inherited code. Provides a systematic methodology — locate trust boundaries, inventory sensitive sinks, trace their controls and data flows, then triage confirmed issues and report with fixes. Apply proactively before shipping or when reviewing third-party c…

  skills/security-auditing-code-review/SKILL.md on GitHub (opens in a new tab)

• security-headers-csp

  Use when adding HTTP response headers to a WordPress site or plugin: Content-Security-Policy (or Report-Only), X-Content-Type-Options, frame protection (X-Frame-Options or frame-ancestors), Referrer-Policy, Permissions-Policy, HSTS, Secure/HttpOnly/SameSite cookie flags, or CORS on REST responses. Covers the wp_headers filter, the send_headers, login_init and admin_init surfaces, per-request CSP…

  skills/security-headers-csp/SKILL.md on GitHub (opens in a new tab)

• settings-options-security

  Use when building an options or settings page with the WordPress Settings API - register_setting, add_settings_field, settings_fields, an options.php form, or update_option / get_option on plugin data. Attaches a sanitize_callback to every setting, gates the page with manage_options, relies on Settings API nonce handling, and escapes options on output. Prevents stored XSS and unauthorized option…

  skills/settings-options-security/SKILL.md on GitHub (opens in a new tab)

• shortcode-block-security

  Use when registering a shortcode with add_shortcode or a dynamic block with a render_callback, or processing shortcode / block attributes. Normalizes attributes with shortcode_atts, validates against allowlists, and escapes all rendered output for its context with esc_html, esc_attr, esc_url, or wp_kses_post. Prevents stored and reflected XSS in rendered content.

  skills/shortcode-block-security/SKILL.md on GitHub (opens in a new tab)

• sql-injection-prevention

  Use when writing any custom database query in WordPress with $wpdb — get_results, get_var, get_row, query, or building WHERE/IN/LIKE/ORDER BY clauses. Uses $wpdb->prepare() with correct placeholders (%d, %s, %f, %i), $wpdb->esc_like() for LIKE, and allowlists for identifiers that cannot be parameterized. Prevents SQL injection. Apply proactively to every query containing a dynamic value.

  skills/sql-injection-prevention/SKILL.md on GitHub (opens in a new tab)

• user-data-protection-privacy

  Use when a WordPress plugin or theme stores, processes, or exposes personal data — emails, names, IP addresses, user content, or analytics. Registers data exporters and erasers via wp_privacy_personal_data_exporters / _erasers, declares privacy policy content, anonymizes IPs, and minimizes/secures PII. Helps meet GDPR/CCPA obligations. Apply proactively whenever code touches personally identifiab…

  skills/user-data-protection-privacy/SKILL.md on GitHub (opens in a new tab)

• woocommerce-security

  Use when a plugin extends WooCommerce - reading or writing orders, customer data, or hooking checkout, REST, or the Store API. Sanitizes input with wc_clean, gates shop actions with WooCommerce capabilities like edit_shop_orders, minimizes stored payment data, and escapes customer PII on output. Prevents broken access control and PII / order data exposure.

  skills/woocommerce-security/SKILL.md on GitHub (opens in a new tab)

• wp-cli-security

  Use when registering a WP-CLI command with WP_CLI::add_command or writing command logic. Validates and sanitizes positional and associative arguments, does not assume a logged-in user or capability context, avoids printing secrets, and confirms destructive operations. Prevents injection and unsafe automation through the CLI surface.

  skills/wp-cli-security/SKILL.md on GitHub (opens in a new tab)

• wp-hardening-best-practices

  Use when configuring or hardening a WordPress site, editing wp-config.php, writing .htaccess or nginx rules, setting file permissions, or advising on deployment security. Covers security keys, DISALLOW_FILE_EDIT, FORCE_SSL_ADMIN, disabling debug output, blocking PHP execution in uploads, protecting sensitive files, and least-privilege file permissions. Apply proactively when setting up or reviewi…

  skills/wp-hardening-best-practices/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• skillsby NVIDIA Agent Skills for NVIDIA products — install into Claude Code, Codex, and other coding agents to run Physical AI, robotics, simulation, CUDA,… 3.6k stars · 30 skills
• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 270k stars · 1 skill
• ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote. 164k stars · 6 skills
• taste-skillby Leonxlnx Agent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages 97.3k stars · 13 skills
• archifyby tt-a1i Turn any idea, plan, or codebase into a beautiful interactive diagram. An agent skill for Claude Code, Codex, and more. 84.1k stars · 2 skills
• awesome-claude-skillsby ComposioHQ A curated list of awesome Claude Skills, resources, and tools for customizing Claude AI workflows 77.2k stars