Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseOpenClawOpenClaw+21 more

    WordPress Plugin Engineering

    1

    Ship WordPress plugins with safe hooks, clean lifecycle routines, secure admin settings, and release-ready packaging.

    Free

    1 installSecurity scanned
    WordPress Plugin Engineering

    WordPress Plugin Engineering

    Example session with this skill installed

    I have a half-finished plugin at wp-content/plugins/event-sync/event-sync.php that syncs event data to an external endpoint daily. Review and harden it: activation and uninstall look suspect, the options page saves raw POST data with no nonce, and the cron job never gets cleared on deactivation. Target WordPress 6.9, PHP 7.4, single site. Fix the security issues, make uninstall conservative so it only removes data the plugin owns, keep the settings screen working, and package a 1.1.0 release ZIP with an updated readme.txt.

    • Read your context and instructions
    • Compiled the wordpress plugin engineering

    Summary

    Audited event-sync for lifecycle safety, input handling, and scheduling, applied fixes, and packaged a 1.1.0 release archive.

    MetricBeforeAfter
    Uninstallmissing — options leaked after removaluninstall.php guards WP_UNINSTALL_PLUGIN, deletes only event_sync_options, transients, and owned tables
    Settings saveraw $_POST, no nonce or capability checkSettings API + sanitize_text_field(), current_user_can('manage_options') gate
    Cron hygienewp_schedule_event() fired on every page loadwp_next_scheduled() guard; wp_clear_scheduled_hook() on deactivation
    Output escaping14 direct echo statementsesc_html / esc_attr / esc_url throughout admin and frontend

    Artifacts delivered: includes/Activator.php, includes/Deactivator.php, uninstall.php, updated readme.txt, and event-sync-1.1.0.zip.

    Next steps

    • Install the ZIP on staging and confirm the options page saves and renders correctly
    • Activate/deactivate once, then run wp cron event list to verify the event is cleared
    • Regenerate languages/event-sync.pot if new user-facing strings were added

    Connects securely to your tools. The creator never sees your data.

    About this skill

    The problem

    Building WordPress plugins often results in messy hook registration, insecure data handling, and incomplete lifecycle routines. Developers struggle to implement the Settings API correctly or fail to clean up data upon uninstallation, leading to technical debt and repository rejection.

    What it does

    • Generates predictable, namespaced plugin structures with separated admin and frontend logic.
    • Implements secure activation, deactivation, and uninstall routines that handle multisite and custom tables.
    • Scaffolds Settings API screens with built-in sanitization, validation, and nonce protection.
    • Architects idempotent WP-Cron tasks with locking mechanisms for safe background processing.
    • Applies strict security patterns for SQL preparation, output escaping, and capability checks.

    Frameworks & tools

    PHP 7.2+, WordPress Core API, WP-CLI, and standard WordPress plugin headers. Works with standard LAMP/LEMP stacks and local development environments like Local or DevKinsta.

    Why this beats prompting it yourself

    Standard LLMs often suggest deprecated hooks or omit critical security steps like check_admin_referer. This skill enforces a production-ready directory layout and ensures data persistence follows dbDelta and $wpdb best practices, preventing common bugs in multisite environments.

    Use cases

    • Architecting a new feature-rich plugin from a clean bootstrap.
    • Hardening an existing plugin for submission to the WordPress.org repository.
    • Adding background processing or scheduled cleanup tasks to a legacy codebase.
    • Refactoring procedural plugin code into a maintainable, object-oriented structure.

    Known limitations

    Does not provide specialized boilerplate for Block Editor (Gutenberg) components or WooCommerce-specific extension classes. Requires manual execution of build scripts for JS/CSS assets.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    1 install

    Downloaded by developers to date

    Free forever

    No account required to browse

    Trust & safety

    Security scanned

    Verified clean 5 days ago

    • Free to download with an account

    Listed5 days ago

    What's inside

    Frequently Asked Questions