Wp Guard
If you've ever had Claude write a WordPress plugin that looked fine until you noticed the raw echo of $_POST data or the AJAX handler with no nonce check, this is the guardrail you needed three plugins ago. It enforces the unglamorous essentials that separate demo code from production code: escaping at output, sanitization on input, prepared statements for every query, capability checks on state changes, translation wrappers on user strings, and query discipline so you don't accidentally fetch ten thousand posts. Best run reactively after code generation, not during. It catches the systematic failures AI makes with WordPress security and i18n, the kind WPCS would flag if you remembered to run it.
- skills.sh installs
- 2.7K
- GitHub stars
- 1.3K
- last updated
- Aug 21, 2026
Install
$ npx -y skills add amelnagdy/guard-skills --skill wp-guard --agent claude-codeInstalls into .claude/skills of the current project.
Files
WP Guard
You are reviewing generated or changed WordPress code before it ships. Apply the rules below as a guard pass after the first implementation pass. Be a sharp reviewer, not a pedantic one: flag what creates vulnerabilities, breaks translations, or melts servers — ignore cosmetic preferences WPCS tooling already handles.
These rules exist because AI agents produce WordPress code with systematic failures: raw echo of request data, AJAX handlers with neither nonce nor capability check, SQL built by string interpolation, English hardcoded into user-facing strings, posts_per_page => -1 on sites with a million posts, and hand-rolled replacements for APIs core already ships. Each one looks fine in a demo and fails in production.
How to use this skill
Guard-pass mode (recommended): after WordPress code has been generated or edited, apply the rules to the diff or target files, then run the self-check before delivery. Fix violations before showing the user.
Live mode (explicit): when the user invokes this skill before writing WordPress code, apply the same rules while writing, then run the self-check before delivery.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/amelnagdy/guard-skills
- Categories
- Backend & APIs, Testing & QA, Git & Pull Requests, Code Review & Quality, AI & Agent Building, Release Management, Automation & Workflows, CLI & Terminal, PHP & Laravel, Databases
- First seen
- Jun 11, 2026
More from amelnagdy/guard-skills
All 5Recommended
More Backend & APIs
copilotkit-upgradecopilotkit/copilotkitUse when migrating a CopilotKit v1 application to v2 -- updating package imports, replacing deprecated hooks and components, switching from GraphQL runtime to A2.6Kskills.sh installs
woo-guardamelnagdy/guard-skillsReview generated or changed WooCommerce code — extensions, payment and shipping integrations, checkout customizations, and order/product logic — before it ships2.6Kskills.sh installs
registryframes-engineering/skillsPay-per-call API gateway for AI agents. 10 services available via x402 — no API keys, no subscriptions.2.6Kskills.sh installs
aihotkkkkhazix/khazix-skills查询 AI HOT 的中文 AI 资讯、精选、当前热点和日报。用户询问今天或最近的 AI 新闻、AI 圈动态、大模型或产品发布、OpenAI／Anthropic／Google 最新消息、AI 论文、AI 日报、AI HOT 精选、当前最热事件，或需要同步当前全部精选时使用。必须通过 aihot.virxact.com 2.6Kskills.sh installs
blog-taxonomyagricidaniel/claude-blogExtract, suggest, and sync tags and categories for blog posts across all major CMS platforms. Supports WordPress REST API, Shopify GraphQL, Ghost Content API, S2.5Kskills.sh installs
convex-http-actionswaynesutton/convexskillsExternal API integration and webhook handling including HTTP endpoint routing, request/response handling, authentication, CORS configuration, and webhook signat2.5Kskills.sh installs