RepoAI
Browse MCPs

WP Abilities Verify

94TrustedInstructions only

WordPress plugin Abilities API registrations validated for security and logic accuracy.

What it does

Wp Abilities Verify ensures the integrity of plugin ability registrations by identifying discrepancies between declared metadata and actual code execution. It protects against mislabeled operations, such as functions claiming to be read-only while performing write actions, which could otherwise cause unintended side effects during automated planning. By comparing annotations against callback behavior, this tool maintains the reliability of agent-driven tasks within your environment. It operates through static source code analysis or by interacting with a live WordPress instance to observe real-world behavior. The assistant provides a structured report detailing potential issues in schema compliance, permission gate logic, and registration consistency across your plugin files.

When it earns its place

Reach for it when…

This skill is essential during the final stages of plugin development before merging new code or when verifying the health of an existing project after significant refactoring. Use it to confirm that abilities function exactly as described, ensuring that security-critical claims about permission gates and data modification remain accurate and consistent with the underlying implementation.

Look elsewhere when…

It is not designed for general WordPress plugin security auditing, such as finding SQL injection or cross-site scripting vulnerabilities. Furthermore, this tool is ineffective if the plugin lacks registered abilities entirely or if it does not use the specific Abilities API structure, as it cannot infer intent from generic, non-registered functions.

What to say to use it

You never invoke a skill directly — the assistant picks it up when your request matches what it covers. These are the kinds of things that do that.

  • check if my plugin abilities are correctly registered
  • verify these read-only annotations against the actual code
  • run a validation check on my plugin ability registration files
  • does this ability callback actually write to the database

Install it

Install for all your projects

Copy the skill directory into your personal skills folder. Claude picks it up on its own the next time your request matches what it does — there is nothing to enable.

bash
git clone --depth 1 --branch trunk https://github.com/WordPress/agent-skills.git /tmp/agent-skills
mkdir -p ~/.claude/skills
cp -r /tmp/agent-skills/skills/wp-abilities-verify ~/.claude/skills/wp-abilities-verify

Install for one project only

Put it in the project's own skills folder instead, so it can be committed and shared with everyone working on that repository.

bash
cp -r /tmp/agent-skills/skills/wp-abilities-verify .claude/skills/wp-abilities-verify

If a skill of the same name exists in both places, the personal one wins.

Installing on Claude.ai or through the API instead? The full guide covers every surface.

Pair it with an MCP server

WP Abilities Verify changes how the work is done. These servers change what Claude can reach while doing it.

How skills and MCP servers differ →