Wp Abilities Verify

Catches the security nightmare where a WordPress ability claims to be readonly but actually writes to the database. Runs in two modes: static analysis from source that scans callback bodies for write patterns, or runtime mode that spins up an environment and executes abilities against live WordPress. You'd use this before merging ability registrations or as a health check after refactors. Also validates audit documents from wp-abilities-audit, checks permission gates, and lints schemas. The adversarial annotation correctness check is the centerpiece here, because agents plan actions based on introspected annotations, so a lying readonly flag breaks both security and UX assumptions. Runtime mode adds idempotency verification via twin invocation heuristics.

skills.sh installs: 2.8K
GitHub stars: 2.3K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add wordpress/agent-skills --skill wp-abilities-verify --agent claude-code

Installs into .claude/skills of the current project.

Files

WP Abilities Verify

Verify a WordPress plugin's Abilities API registrations. The centerpiece is the adversarial annotation correctness check: a readonly: true ability that actually writes (via $wpdb->update, update_option, a non-GET delegate, etc.) is a security and UX disaster because agents plan actions on the basis of the annotations they introspect. This skill catches those lies by reading the callback body and comparing what it does against what the annotation claims.

The skill also validates audit docs produced by wp-abilities-audit, checks permission gates and schema hygiene, and optionally executes each ability against a live environment.

When to use

After abilities have been registered in a plugin but before a PR lands.
As a health-check on an already-shipped plugin (catch regressions where a refactor turned a readonly ability into a writing one).
To validate an audit document before handing it to an implementer.