WordPress Security Skills
27 WordPress security skills: an agent checks nonces and capabilities, escapes output and reviews plugins with checklists.
- 56 ★ on the repository
- Last commit
- MIT
Minimal access
Why this level
- The skills contain only instructions and code examples and run nothing themselves.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/wordpress-security-skillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- The skills contain only instructions and code examples and run nothing themselves.
This is third-party code. Review the repository files before installing.
What it does
A set of 27 skills teaches an agent to write and review WordPress plugins and themes without typical security mistakes. Each skill covers one topic with wrong-versus-right examples and a checklist. Topics include `nonce` and capability checks, output escaping, prepared SQL queries, file upload handling, REST and `admin-ajax`, settings, shortcodes, Gutenberg blocks, WP-CLI, cron jobs and dependency supply chain security. A separate `security-auditing-code-review` skill runs the audit: confirmed vulnerabilities are separated from open questions and hardening advice, and severity is rated from evidence. Every API links to the official WordPress documentation. The skills improve the agent's instructions and do not protect a live site.
Who it is for. WordPress plugin and theme developers who write code with an agent and want secure choices by default.
Good fit when
- A new plugin starts and the agent should add `nonce` and capability checks from the beginning.
- You need an audit of a third-party or old plugin with severity rated from evidence.
- REST routes, `admin-ajax.php` handlers or file uploads are being added.
- An AI assistant is built into a plugin and the permissions of its tools need checking.
Not a fit when
- You need a scanner or runtime protection for a site: the skills only guide the agent.
- The project is not WordPress: the rules are tied to its APIs.
- You expect a security guarantee on the final code without your own review.
Example request
Audit this WordPress plugin: find confirmed vulnerabilities, list open questions separately and rate severity from evidence.Limitations
This is not a WordPress plugin, a scanner or runtime site protection. The skills improve the agent's instructions but do not guarantee secure output: review the code after the agent yourself. Installing through `npx skills` needs Node.js. Narrow skills such as multisite, WP-CLI and AI integration in plugins matter only when you work on those topics. The default repository branch is `dev`, so compare the set version with the latest GitHub release.
How to disable. Delete the skill folders from the project skills directory or the agent's global directory. Nothing else changes on the site or in the project.
FAQ
How do I install the skills?
Run `npx skills add wpultimatesecurity/WordPress-Security-Skills` in the project: it asks which skills and which scope. A prompt-free variant is `npx --yes skills add wpultimatesecurity/WordPress-Security-Skills`.
Which agents work?
The README names Claude Code, Cursor, Codex, OpenCode and Gemini CLI. Any agent that reads skills under the Agent Skills spec fits.
Which skill should I start with?
`secure-plugin-development` for new code and `security-auditing-code-review` for checking finished code. The rest apply by topic.
How do I install without a command?
Ask the agent to install the skills from the repository: the README has a ready prompt. It keeps your skills and commits nothing.
Does the set check a live site?
No. The skills only improve the agent's instructions for plugin and theme code. The set is neither a scanner nor site protection.
Discussion
No questions or reviews yet.
Related
SkillsA security audit skill built on OWASP Top 10, CWE and CVSS, with deep PHP and TYPO3 scanning across 80-plus checkpoints.
Cybersecurity Skills
Cybersecurity Skills for AI Agents
42 security skills for Claude Code, Cursor and Codex: code and cloud audits, authorization-gated pentesting and incident response
A code security audit skill by Cloudflare: the agent runs recon, coverage-led hunting and independent verification of findings, then produces a structured repor
A plugin with 88 Microsoft security skills: Defender, Sentinel, Entra, Purview and Intune for Copilot, Claude Code and Cursor.
VibeSec
VibeSec-Skill
A secure coding skill: the agent looks at code from a bug hunter's perspective and prevents common web vulnerabilities
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
README in short
The README explains the mistakes agents make in WordPress code and lists what the set does and does not give. Two install options, skill groups by topic and manual installation follow.