wp-plugin-development Skill for Claude Code: What It Does and How to Install It

Makes Claude build and fix WordPress plugins: structure, hooks, settings pages, data, cron and security.

Installs: 8.3K; on skills.sh
Stars: 2.3K; on GitHub
Files: 7; besides SKILL.md
Updated: Oct 2026; last repo commit

This skill comes from the WordPress project's own agent-skills repo. It gives Claude a procedure for plugin work: locate the plugin, keep one bootstrap file, register hooks safely, handle activation, deactivation and uninstall, use the Settings API, and apply a security baseline before shipping. Six reference files hold the detail.

Its first step runs two Node scripts: the detector from the sibling skill wp-project-triage and its own detect_plugins.mjs, so you need both skills installed. It targets WordPress 7.0+ (PHP 7.4.0+) and expects a filesystem agent with bash and Node. Some workflows need WP-CLI.

Good for

WordPress plugin developers adding hooks, settings pages or uninstall cleanup
Developers fixing nonce, capability, sanitizing and escaping problems
Teams packaging a plugin release

Install wp-plugin-development

Claude Code

Copy this prompt.

Install the wp-plugin-development skill in Claude Code. Run this command:

npx skills add WordPress/agent-skills --skill wp-plugin-development wp-project-triage

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

Install wp-project-triage with this skill: step 0 in SKILL.md runs a script from that skill. The folder routes below need both folders. The README also documents building the whole pack from a clone. There is no Claude app tab because the skills run Node scripts in your repo.

Built from the package data we hold. Not yet tested by us. Source.

What's in the skill

When it loads

Use when developing WordPress plugins: architecture and hooks, activation/deactivation/uninstall, admin UI and Settings API, data storage, cron/tasks, security (nonces/capabilities/sanitization/escaping), and release packaging.

Sections in SKILL.md

When to use
Inputs required
Procedure
0) Triage and locate plugin entrypoints
1) Follow a predictable architecture
2) Hooks and lifecycle (activation/deactivation/uninstall)
3) Settings and admin UI (Settings API)
4) Security baseline (always)
5) Data storage, cron, migrations (if needed)
Verification
Failure modes / debugging
Escalation

Key facts

Author: WordPress Contributors (named in the LICENSE); the WordPress project's own agent-skills repo
License: GPL-2.0-or-later (README and LICENSE agree); GitHub shows "Other"
Installs on skills.sh: 8,298 (Nov 2, 2026)
GitHub stars: 2,319 for the whole WordPress/agent-skills repo (Nov 2, 2026)
Last repo commit: Oct 26, 2026
What it includes: 8 files: SKILL.md, 6 reference files and scripts/detect_plugins.mjs
Targets: WordPress 7.0+ (PHP 7.4.0+); filesystem agent with bash and Node; some workflows need WP-CLI
Needs: The sibling skill wp-project-triage for step 0

What it includes

Runs detect_wp_project.mjs and detect_plugins.mjs to find plugin entrypoints
The first script comes from the wp-project-triage skill. The second scans for plugin headers. For a full site repo, pick the plugin under wp-content/plugins or mu-plugins first.
Try: “Find the plugin in this repo and add a settings page”
Runs code · 0) Triage and locate
One bootstrap file, hooks registered by a loader, admin code behind is_admin()
Avoid heavy work at file load time. Detail in references/structure.md.
Write · 1) Architecture
Activation, deactivation and uninstall done safely
Register activation hooks at top level, flush rewrite rules only when needed, and make uninstall explicit. Detail in references/lifecycle.md.
Write · 2) Hooks and lifecycle
Settings API with register_setting, sections and fields, with sanitize callbacks
Detail in references/settings-api.md.
Write · 3) Settings and admin UI
Validate input early, escape output late, nonces plus capability checks, $wpdb->prepare()
Marked "always" in SKILL.md. Detail in references/security.md.
Write · 4) Security baseline
Options for small config, custom tables only if needed, idempotent cron, schema versions
Detail in references/data-and-cron.md.
Write · 5) Data, cron and migrations
Plugin activates, settings save, uninstall removes only intended data, tests run
Runs the repo's PHPUnit or PHPCS and JS build steps if present.
Runs code · Verification
Why an activation hook does not fire, settings do not save, or security regresses
Detail in references/debugging.md.
Failure modes

From the official docs

Permissions

Medium risk

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It edits plugin code, including uninstall and database code
SKILL.md covers activation, uninstall, migrations and custom tables. A wrong uninstall routine can delete data. SKILL.md says uninstall should remove the intended data and nothing else, so review that code. github.com
It runs scripts and project commands
Step 0 runs two Node scripts. Verification runs the repo's PHPUnit, PHPCS and JS build steps if present. These run whatever the repo defines. github.com
Install via clone runs build scripts
The README's source route runs node shared/scripts/skillpack-build.mjs and skillpack-install.mjs from a clone. The skills CLI route does not. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Scopes	Runs two Node scripts that read your repo Edits plugin PHP and related files Runs the repo's lint, test and build commands during verification Some workflows need WP-CLI

Questions

What does wp-plugin-development do?

It makes Claude follow a set procedure for WordPress plugin work. It covers plugin structure, hooks, lifecycle, the Settings API, a security baseline, data and cron, then checks the result.

Is it official?

It is in the WordPress project's own agent-skills repo, and the LICENSE names WordPress Contributors. Read the repo's docs for how skills are written and reviewed.

How do I install it?

Use the install box above. It installs this skill together with wp-project-triage, because step 0 runs that skill's script. The README documents npx skills add WordPress/agent-skills with a --skill list and a build-and-install route from a clone.

Why does it need wp-project-triage?

SKILL.md step 0 runs node skills/wp-project-triage/scripts/detect_wp_project.mjs to inspect the repo before any edit.

Which WordPress versions does it target?

WordPress 7.0+ with PHP 7.4.0+, per the compatibility line in SKILL.md. It expects a filesystem agent with bash and Node, and some workflows need WP-CLI.

Does it work in the Claude app?

The README does not name the Claude app, and the skill runs Node scripts in your repo, so the install box has no Claude app tab. The README lists Claude Code, Cursor, Codex, VS Code with Copilot and Antigravity targets.

What do the Node scripts do?

detect_plugins.mjs imports node:fs and node:path, reads PHP files in the repo and prints a JSON report to standard output. The triage script is in the sibling skill.

Is it safe?

It edits your plugin code and runs Node scripts and, in verification, your repo's lint and test commands. Our advice: use version control, review the diff, and check that uninstall code removes only the data you intend.

Information

updated Nov 2, 2026

Repository: wordpress/agent-skills
Folder: skills/wp-plugin-development

wordpress/agent-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 6

README.md · github.com
SKILL.md · github.com
SKILL.md · github.com
lifecycle.md · github.com
detect_plugins.mjs · github.com
LICENSE · github.com