wp-dev-skills

Use when a pull request has QA failures, a "Testing Failed" label, or QA comments reporting broken features — reading QA feedback and PR comments, tracing root cause using root-cause-patterns.md, applying scoped conventional-commit fixes, swapping labels (Testing Failed to Need Testing), and posting a structured QA re-test comment. Triggers: "QA failed my PR", "Testing Failed label on my PR", "fix the QA comments on PR", "QA says feature X is broken", "post a re-test comment", "how do I respond to QA feedback", "CI is failing on my PR", "QA reopened the ticket", "update the PR label after fixing", "testing failed label", "QA comment says the button is broken", "phpcs failing in CI", "yarn lint error on the PR", "npm run build failing in CI", "root cause of the QA failure", "write a re-test instruction comment", "fix failing checks on this PR", "QA triage workflow", "phpcs prints nothing and exits 0", "composer run test produces no output", "phpstan workers keep crashing", "did my static checks actually run",

Use when building, extending, or debugging a WooCommerce plugin — custom product types, payment gateways (WC_Payment_Gateway, process_payment(), process_refund()), shipping methods (WC_Shipping_Method, calculate_shipping()), CRUD via WC_Product / WC_Order / WC_Customer (wc_get_product, wc_create_order, wc_get_orders, get_meta, update_meta_data), HPOS compatibility (FeaturesUtil::declare_compatibility, wc_get_orders instead of WP_Query on posts), REST API extensions (woocommerce_rest_prepare, woocommerce_rest_pre_insert, Store API woocommerce_store_api_register_endpoint_data), cart/checkout blocks (registerCheckoutFilters, extensionCartUpdate, SlotFills), key hooks (woocommerce_cart_calculate_fees, woocommerce_checkout_fields, woocommerce_order_status_changed, woocommerce_payment_gateways), or WooCommerce subscription/coupon/webhook logic. Triggers: "WooCommerce extension", "custom product type", "payment gateway", "hook into WooCommerce checkout", "WC_Order", "wc_create_order()", "wc_get_product()", "add a sh

Use when a WordPress plugin needs to run work outside the HTTP request cycle — scheduling async or recurring jobs with Action Scheduler (as_enqueue_async_action, as_schedule_single_action, as_schedule_recurring_action, as_unschedule_action), implementing WP_Background_Process (push_to_queue, save, dispatch, is_queue_empty), registering WP Cron events (wp_schedule_event, wp_clear_scheduled_hook), batch-processing large datasets without hitting PHP timeouts, tracking job progress, handling retries on failure, or debugging the actionscheduler_actions table. Triggers: "schedule this for later", "run this without hitting timeout", "queue these items for background processing", "why is my cron not running", "Action Scheduler job keeps failing", "as_enqueue_async_action", "WP_Background_Process", "push_to_queue", "dispatch the queue", "DISABLE_WP_CRON", "process records in batches", "send emails in the background", "WP Cron not firing", "batch import without timeout", "scheduled action not running", "background job

Use when setting up, configuring, or debugging the JavaScript/CSS build pipeline for a WordPress plugin — @wordpress/scripts, webpack (webpack.config.js, entry points, externals), Vite, block editor asset compilation with block.json, enqueueing built assets with .asset.php dependency files, wp_enqueue_script / wp_localize_script, Sass/SCSS/PostCSS compilation, TypeScript support, register_block_type, or reusing a JS/CSS library already bundled by a host plugin (EDD, WooCommerce, Elementor). Triggers: "npm run build fails", "webpack config error", "my script is not loading", "set up @wordpress/scripts", "enqueue my block assets", "why is my CSS not compiling", ".asset.php not found", "how do I reuse this bundled library", "TypeScript in a WP plugin", "block.json attributes", "missing dependency in build", "wp_enqueue_script not loading", "externals in webpack", "Vite for WordPress", "Sass not compiling", "PostCSS setup", "build output is in the wrong folder", "npm ci vs npm install", "externalize React from my

Use when setting up PHPCS with WordPress Coding Standards (WPCS), configuring phpcs.xml.dist, running phpcs/phpcbf, fixing sniff violations, adding PHPCS to CI (GitHub Actions), configuring IDE integration, or verifying a plugin meets WP.org code style requirements. Covers squizlabs/php_codesniffer, wp-coding-standards/wpcs, dealerdirect/phpcodesniffer-composer-installer, WordPress-Extra, WordPress-Docs, WooCommerce-Core rulesets. Triggers: "phpcs error", "WPCS violation", "fix my code style", "set up PHPCS", "configure phpcs.xml.dist", "my code fails PHPCS", "add linting to CI", "WordPress.Security.EscapeOutput sniff", "WordPress.WP.I18n error", "WordPress.NamingConventions sniff", "how do I ignore a phpcs rule", "phpcbf auto-fix", "phpcs in GitHub Actions", "add PHPCS to pre-commit hook", "vendor/bin/phpcs -i", "WordPress-Extra ruleset", "WordPress-Docs ruleset", "WooCommerce sniff", "phpcs.xml.dist example", "phpcs says my spacing is wrong", "fix indentation for WP standards", "PHPCS not finding WPCS", "de

Use when submitting a WordPress plugin to the WP.org directory for the first time, deploying a new version via SVN (plugins.svn.wordpress.org trunk, tags, assets), fixing a reviewer rejection (17-issue catalog with exact reviewer quotes), writing or correcting readme.txt (Stable tag, Changelog, Upgrade Notice, Requires, Tested up to, External services), or preparing WP.org assets (banner-772x250.png, banner-1544x500.png, icon-128x128.png, icon-256x256.png, icon.svg, screenshot-N.png). Triggers: "submit my plugin to WP.org", "SVN deploy", "reviewer rejected my plugin", "fix WP.org review feedback", "how do I set up the SVN repo", "WP.org assets", "prepare my plugin for the directory", "what does the reviewer want", "Stable tag", "readme.txt requirements", "WP.org banner dimensions", "fix this reviewer comment", "plugin zip for submission", "svn commit trunk", "svn cp trunk tags", "reviewer says missing nonce", "reviewer says not prefixed", "reviewer says missing sanitization", "Upgrade Notice section", "Extern

Use when auditing a WordPress plugin for security issues, code inconsistencies, or quality gaps — fans out parallel checks across four dimensions: A (version/metadata sync), B (naming/prefix/i18n), C (docs vs code), D (code conventions/security), verifies every finding with file:line references before reporting, and routes confirmed issues to the correct fix skill. Security patterns checked: XSS (missing esc_html/esc_attr), SQL injection (raw $wpdb), CSRF (missing nonce), missing capability checks, file upload validation, object unserialize, open redirect, path traversal, REST auth hardening. Triggers: "audit this plugin", "find inconsistencies in my plugin", "security review", "check my plugin for XSS", "is my escaping correct", "find missing nonces", "check capabilities in my plugin", "audit readme.txt", "find security issues", "plugin quality sweep", "are there SQL injection risks", "review my plugin before submission", "missing esc_html()", "raw wpdb query without prepare()", "missing current_user_can()",

Use when bumping a WordPress plugin version or cutting a release — syncing version across all sources: plugin header (Version: X.Y.Z), version constant (define MY_PLUGIN_VERSION), readme.txt (Stable tag + Changelog + Upgrade Notice), CHANGELOG.md, and .pot Project-Id-Version; following semver (major/minor/patch) rules; running pre-release checks (composer lint / analyze / test, grep for stale version strings); creating a git tag; and deciding what NOT to bump (DB schema version, historical changelog entries). Triggers: "release version 1.2.3", "bump the version", "update the changelog", "sync version numbers", "prepare the release", "tag this version", "version is out of sync", "update Stable tag", "what needs to change for a release", "changelog entry", "update readme.txt version", "bump to 2.0.0", "Version header in plugin file", "define MY_PLUGIN_VERSION", "semver patch vs minor vs major", "Project-Id-Version in POT", "grep for old version strings", "git tag for release", "Upgrade Notice section", "what to

Use when emitting JSON-LD structured data (schema.org) from a WordPress theme or plugin — FAQPage, HowTo, ItemList, Recipe, Event, Product, Review — especially when the data lives in post meta / custom fields the SEO plugin can't see, OR when you must avoid duplicating the schema an SEO plugin (Rank Math, Yoast SEO, SEOPress) already outputs. Covers building the @graph in PHP, escaping with wp_json_encode, printing on wp_head, validating, and coexisting with SEO-plugin graphs. Triggers: "add FAQ schema", "FAQPage JSON-LD", "add structured data", "schema.org markup WordPress", "rich results", "HowTo schema", "ItemList schema", "my FAQ rich result isn't showing", "duplicate Article schema", "Rank Math already outputs schema", "Yoast schema graph", "json-ld in head or footer", "wp_json_encode schema", "schema for custom fields", "breadcrumb schema duplicate", "validate structured data". Not for: configuring an SEO plugin's built-in schema UI (use the plugin's own settings); meta tags / OpenGraph (that's SEO-plug

Use when a WordPress plugin needs a custom database table — creating with dbDelta (strict SQL format: two spaces before PRIMARY KEY, no trailing comma), writing versioned upgrade routines with version_compare and register_activation_hook, querying with $wpdb prepared statements (prepare, insert, update, delete, get_row, get_results, get_var), debugging with $wpdb->last_error or SAVEQUERIES, schema migrations between plugin versions, uninstall cleanup, multisite table handling with switch_to_blog / get_sites, or seeding test/preview data into custom tables. Triggers: "create a custom table", "dbDelta not working", "dbDelta not creating my table", "write a migration", "wpdb query", "wpdb prepare", "slow query on my custom table", "upgrade my database schema", "add a column to my table", "seed test data", "how do I store this in a custom table", "database upgrade routine", "table not being created on activation", "prepare placeholder wrong", "last_error is empty after query", "SAVEQUERIES debug", "version_compar

Use when writing or setting up tests for a WordPress plugin — PHPUnit integration tests using WP_UnitTestCase with the WP test suite (bin/install-wp-tests.sh, phpunit.xml.dist, tests/bootstrap.php), unit tests with Brain Monkey (when() / expect() / Mockery) or WP_Mock, test factories (factory()->post->create(), ->user->create(), ->term->create()), HTTP request mocking with add_filter pre_http_request, AJAX testing with WP_Ajax_UnitTestCase, redirect/exit testing via exception-throwing pattern, multisite tests (WP_MULTISITE=1), acceptance tests with Codeception + wp-browser, or GitHub Actions CI matrix for PHP x WP versions. Triggers: "write a test for this", "unit test this function", "set up PHPUnit for my plugin", "mock this WP function", "Brain Monkey setup", "WP_Mock", "test is failing", "how do I test a hook", "test my REST endpoint", "factory()->post->create()", "install the WP test suite", "test my wp_mail call", "integration test setup", "bin/install-wp-tests.sh", "phpunit.xml.dist", "WP_UnitTestCase"

Use when a WordPress admin panel needs real browser interaction via Chrome DevTools MCP — logging in, navigating admin menus, clicking buttons, filling and submitting forms, creating/editing/deleting content through the UI, creating a temporary test admin user, verifying JS state or localStorage, capturing screenshots, or obtaining a REST nonce via admin-ajax.php. Triggers: "open WP admin", "log in to WordPress", "navigate to Settings", "create a test user in admin", "click Save Changes", "fill in this form in the browser", "take a screenshot of the admin page", "upload media through the browser", "check the admin menu", "verify this in the browser", "use Chrome DevTools MCP", "fill_form in admin", "evaluate_script in admin", "admin panel is in maintenance mode", "get a REST nonce", "session expired re-login", "interact with the WP dashboard", "navigate to Plugins Add New", "test this in the actual admin UI", "create a temp admin account for testing", "check localStorage in admin". Not for: headless automated

Use when adding or refactoring transactional emails in a WordPress plugin — extracting inline HTML strings into reusable templates sharing a branded base shell, implementing the render_template helper (ob_start / include / ob_get_clean), passing variables safely with extract(EXTR_SKIP), sending via wp_mail(), testing with MockPHPMailer / tests_retrieve_phpmailer_instance(), applying table-based HTML layout and inline CSS for email clients, or handling wp_mail send-failure branches. Triggers: "send an email from my plugin", "wp_mail not working", "add an email template", "style my plugin emails", "HTML email in WordPress", "branded email wrapper", "email not arriving", "test my wp_mail", "add a CTA button to the email", "make emails look good in Outlook", "transactional email template", "render_template helper", "ob_start for email", "extract EXTR_SKIP", "MockPHPMailer in tests", "tests_retrieve_phpmailer_instance", "pre_wp_mail filter to test failure", "inline CSS email", "dark mode email support", "table-bas

Use when integrating Freemius SDK into a WordPress plugin for monetisation — SDK bootstrap with fs_dynamic_init, feature gating with can_use_premium_code() / is__premium_only() / is_plan() / is_trial() / is_paying(), license management, free/pro dual-zip build using __premium_only__ file suffix, generating upgrade URLs with get_upgrade_url(), opt-in analytics dialog, multisite licensing, affiliate program, or debugging Freemius dashboard (Plans, Pricing, Licenses, Updates). Triggers: "add Freemius to my plugin", "gate this feature behind pro", "show the pricing page", "check if user has a license", "Freemius not initialising", "can_use_premium_code()", "is_plan()", "is_trial()", "is_paying()", "fs_dynamic_init", "my_plugin_fs()", "__premium_only__ file", "set up free and pro versions", "Freemius opt-in dialog", "trial period setup", "license key validation", "monetise my plugin", "get_upgrade_url()", "Freemius affiliate", "is_org_compliant", "Freemius SDK error", "free and premium zip", "Freemius multisite",

Use when shipping work through GitHub — fixing a GitHub issue by URL/number, or committing and PR-ing uncommitted working-tree changes. Covers resolving ISSUE_REPO vs CODE_REPO, grouping changes into scoped conventional commits (type(scope): summary), branching from fresh origin/base, discovering labels via gh label list, opening PRs with gh pr create, cross-repo Closes footer, merging with --merge (never --squash), and re-syncing after merge. Triggers: "commit my changes", "commit scope by scope", "create a branch and PR", "open a PR for these changes", "fix issue #NNN", "debug this GitHub issue", "group my changes into commits", "push and open a PR", "what branch should I use", "conventional commit for this change", "close this issue with a PR", "write a PR description", "gh pr create", "gh issue view", "Closes footer", "branch name for this fix", "gh label list", "bugfix branch", "cross-repo close", "ISSUE_REPO vs CODE_REPO", "stale remote origin", "PR body template", "merge the open PR", "re-sync after me

Use when adding a guided onboarding or feature-discovery tour to a WordPress admin plugin using Driver.js v1 — setting up the IIFE bundle (window.driver.js.driver), PHP backend tour config arrays (autoStart, pages, steps, element, popover), JS scope detection from URL pathname + hash (getCurrentScope, hashchange listener), localStorage-based completion tracking, CSS selector rules for WP admin elements including Tailwind bracket-notation escaping, testing selectors in browser console, and generating/updating the POT file for tour strings. Triggers: "add a guided tour to my plugin", "onboarding walkthrough in WP admin", "Driver.js setup", "highlight this admin element", "step-by-step tutorial in WP admin", "tour not starting", "tour completion not saving", "scope detection for admin pages", "add tooltips to my settings page", "first-run wizard", "window.driver.js.driver", "getCurrentScope()", "hashchange listener for tour", "localStorage tour tracking", "Tailwind selector escaping in PHP", "Driver.js popover",

Use when managing the full translation workflow for a WordPress plugin — registering text domain with load_plugin_textdomain, wrapping strings with __(), _e(), esc_html__(), esc_attr__(), _n(), _x(), _ex(), _nx(), generating POT with wp i18n make-pot, compiling .po to .mo (wp i18n make-mo / msgfmt) and .json (wp i18n make-json), wiring JS translations with wp_set_script_translations and @wordpress/i18n (__, _n, _x, sprintf), adding translator comments, submitting to translate.wordpress.org / GlotPress, automating in GitHub Actions, or debugging missing translations. Triggers: "make this string translatable", "generate POT file", "strings not translating", "wp i18n make-pot", "JS translations not loading", "wp_set_script_translations", "how do I translate my block", "RTL language support", "missing translation", "submit to GlotPress", "translation missing in JS", "update my .po files", "load_plugin_textdomain", "__ vs esc_html__", "_n() plural strings", "_x() context string", "translator comment format", "wp i

Use when building or adapting a WordPress plugin for Multisite/Network — network activation (register_activation_hook with $network_wide), network admin pages (network_admin_menu), per-site vs network-wide options (get_option / get_network_option / update_network_option), looping sites with get_sites() + switch_to_blog() / restore_current_blog(), super admin capabilities (is_super_admin(), manage_network, is_network_admin()), table prefix handling ($wpdb->prefix vs $wpdb->base_prefix), blog ID awareness (get_current_blog_id), or detecting multisite context (is_multisite(), is_plugin_active_for_network()). Triggers: "make my plugin multisite compatible", "network activate", "network admin page", "per-site settings", "switch_to_blog()", "restore_current_blog()", "super admin only feature", "why does my plugin break on multisite", "run this for every site in the network", "network-wide option", "plugin only on certain sites", "blog ID handling", "is_multisite()", "is_network_admin()", "is_plugin_active_for_netwo

Use when creating a new PHPStan stubs package for a WordPress plugin, theme, or Composer package — scaffolding the full repo structure (composer.json, configs/bootstrap.php, configs/finder.php, bin/generate.sh, bin/release-latest-versions.sh, .github/workflows/release.yml, phpstan.neon), fetching version lists from WP.org plugin API (api.wordpress.org/plugins) or Packagist API, using php-stubs/generator, or setting up the GitHub release workflow with jq. Triggers: "create stubs for X plugin", "scaffold PHPStan stubs", "new stubs package", "add PHPStan stubs for WooCommerce", "stubs repo setup", "generate stub file", "PHPStan cannot find this class", "missing type hints for third-party plugin", "add stubs for this Composer package", "php-stubs/generator", "bin/generate.sh", "configs/bootstrap.php for stubs", "configs/finder.php", "release-latest-versions.sh", "WP.org plugin API for versions", "Packagist API for versions", "jq regex error in stubs script", "GitHub Actions release workflow for stubs", "phpstan.n