Agent skill · software engineering · secondsky
wordpress-plugin-core
WordPress plugin development with hooks, security, REST API, custom post types. Use for plugin creation, $wpdb queries, Settings API, or encountering SQL injection, XSS, CSRF, nonce errors.
Why this skill is useful
Provides specific WordPress plugin development patterns and security practices that the AI wouldn't reliably generate on its own.
What it needs
About 10k tokens when loaded. Last updated 2026-08-06. 204 stars on the source repository.
What this skill does
WordPress Plugin Development (Core) Status: Production Ready Last Updated: 2026-08-03 Dependencies: None (WordPress 6.0+, PHP 8.0+) Latest Versions: WordPress 7.0+, PHP 8.3+ recommended --- Quick Start (10 Minutes) 1. Choose Plugin Structure Three architecture patterns available (see references/plugin-architectures.md for detailed examples): Simple (functions only) - Small plugins <5 functions OOP - Medium plugins with related functionality PSR-4 (Namespaced + Composer) - Modern standard (2025), most maintainable 2. Create Plugin Header Every plugin MUST have a header comment in the main file: CRITICAL: Plugin Name is required, Text Domain must match plugin slug exactly. 3. Security Foundation (5 Essentials) --- The 5-Step Security Foundation Step 1: Use Unique Prefix for Everything Rules: 4-5 chars minimum, apply to functions, classes, constants, options, transients, meta keys. Avoid wp, , . Step 2: Check Capabilities, Not Admin Status Common Capabilities: manageoptions (Admin), editposts (Editor), publishposts (Author) Step 3: The Security Trinity Input → Processing → Output (Sanitize → Validate → Escape): Rule: Sanitize INPUT, escape OUTPUT. Never trust user data. Step 4: Nonces (CSRF Protection) One-time tokens proving requests came from your site. Step 5: Prepared Statements for Database CRITICAL: Always use $wpdb->prepare() for user input. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills secondsky/wordpress-plugin-core