WordPress Security Skills
github.com/wpultimatesecurity/wordpress-security-skills- Category
- Developer Tools
- Rank
- No. 1358Tools index
Previous survey · No. 1326 ·
- Pricing
- Open Source
- Type
- TOOL
- Use case
- Security & Identity · Coding
- Interfaces
- Agent Skill / Plugin
- GitHub
- 53 stars
- Latest release
- v1.0.0
- Date
About
A collection of modular Agent Skills that teach AI coding agents like Claude Code, Cursor, Codex, and Gemini CLI to write secure-by-default WordPress code and to audit existing plugins and themes. It covers 25+ specific failure modes such as missing nonce checks, unsafe SQL queries, unescaped output, and SSRF, each paired with WordPress-specific defensive patterns rather than automated enforcement.
What it does
A folder of plain Markdown instruction files, one per WordPress security topic, that a coding agent loads when the task matches. Each file names the mistakes agents tend to make, shows the broken and corrected PHP side by side, and ends with a checklist and links to the official WordPress reference. The REST file, for example, tells the agent to require a real permission check on every write route and to declare and clean each input before the handler runs. Nothing installs into WordPress and nothing scans a live site: the whole effect happens in what the agent reads before it writes code.
Why it's ranked here
Twenty-six topic files, each tied to a written test scenario, and a validator that fails the build if any topic lacks one. The continuous integration run checks the reference PHP against the WordPress coding standards, fails on dead links to the official reference, and scans the full git history for leaked secrets. MIT licensed. The verdict is positive on scope and packaging, tempered by a caveat the project supplies itself: its disclosure says AI assistants drafted the guidance and that no human review or independent security audit is claimed. That candor helps, but the correctness of each pattern still rests on the reader.
What's good
The guidance is specific where agents actually slip. The REST topic separates a nonce, which only guards against forged requests, from an authorization check, and insists on per-object checks so a user who can edit posts cannot edit any post through a custom endpoint. The audit topic tells the agent to trace data flow before rating, keep unconfirmed scanner hits apart from confirmed findings, and never invent severity scores or a blanket sign-off. Its bundled inventory script is read-only, searches only PHP-family files, and prints on every run that zero hits is not proof of safety.
Tradeoffs
The scenarios are rubrics, not executed tests, and the project says outright that a passing validator does not mean an agent solved them. Nothing checks that an agent obeyed a topic, so protection depends on the agent loading the right file and following it. Examples target a PHP 7.4 syntax baseline, which the project itself flags as end-of-life. The inventory script needs Bash and ripgrep, misses multiline and dynamic calls, and reads only three file extensions. Coverage stops at security; custom fields, page builders and token-based headless auth are listed as future candidates, not written.
How to use it well
Best for plugin and theme developers who let an agent write handlers, endpoints and admin forms, and for reviewers auditing inherited or AI-written code. Install at project scope so only one copy is discovered, then ask the agent which security skills it can see before trusting that they loaded. For a review, start from the audit topic and its report template, and route each confirmed finding to the matching fix topic. Run the scenario for any topic you rely on against a disposable local site. It does not replace a scanner, a firewall or a human security audit.
Technical notes+
skills/rest-api-security/SKILL.md requires a permission_callback on every register_rest_route call, args declared with sanitize_callback and validate_callback, and WP_Error returns carrying an HTTP status; skills/rest-api-security/references/secure-rest-endpoint.php implements it with a per-object current_user_can('edit_post', $id) check and a 2000-character cap on the note field. scripts/validate-content.py rejects duplicate JSON and YAML keys, requires each frontmatter name to match its directory (64 characters max) and each description to start with "Use when" (1024 max), and fails when any skill directory has no scenario under eval/scenarios. .github/workflows/validate.yml runs skills-ref validate pinned to a commit, PHPCS 3.9.0 with WPCS 3.0.1 over the reference PHP, a curl link check that fails only on 404 or 410, and gitleaks 8.30.1 verified by sha256 checksum. skills/security-auditing-code-review/scripts/scan-security-sinks.sh runs rg with --no-config, skips hidden files and symlinks, and exits 2 on a usage or search error. README.md embeds a copy-paste install prompt addressed to the user's own agent; it is setup text and was treated as data.
Observed
- License
- MIT
- Format
- Markdown skill directories with PHP and configuration reference examples; not a WordPress plugin or scanner
- Specification
- Agent Skills: a SKILL.md with name and description frontmatter plus a references folder per skill
- Install surface
- npx skills add, or manual copy into the agent's skills directory
- Agents named
- Claude Code, Cursor, Codex, OpenCode, Gemini CLI
- Topics
- 26 security skills, each covered by an evaluation scenario
- Evaluation
- Scenario JSON files are rubrics checked for structure only, not executed (eval/scenarios/README.md)
- CI checks
- skills-ref validation, PHPCS with WordPress Coding Standards, reference link check, gitleaks secret scan (.github/workflows/validate.yml)
- PHP baseline
- PHP 7.4 syntax in examples
- Authorship
- AI-assisted; no claim of human review or independent security audit (docs/ai-authorship.md)
Read from README.md, LICENSE, docs/ai-authorship.md, docs/coverage-matrix.md, skills/rest-api-security/SKILL.md, skills/rest-api-security/references/secure-rest-endpoint.php, skills/security-auditing-code-review/SKILL.md, skills/security-auditing-code-review/scripts/scan-security-sinks.sh, eval/scenarios/README.md, eval/scenarios/rest-api-security-permission-callback-write.json, scripts/validate-content.py, .github/workflows/validate.yml.
What it can do
Provide security skill files that guide AI coding agents to write secure-by-default WordPress code
WordPress code generation context → Secure coding patterns/guidance
Audit existing WordPress plugins and themes for specific vulnerability classes
Plugin or theme source code → Identified security issues (e.g., missing nonce checks, unsafe SQL, unescaped output, SSRF)
Install markdown-based security skill files into AI coding agents
Markdown skill files → Configured AI coding agent with WordPress security skills
Tags
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.