wp-skills

Use when auditing a WordPress plugin for security, performance, coding standards, and WordPress.org guidelines compliance. Triggers: "audit this plugin", "review the plugin", "is this plugin secure", "code audit", "security review", "plugin code review", "is this plugin safe to install", "check this plugin for vulnerabilities", "review plugin for performance", or any request to evaluate the quality / safety of a WordPress plugin from a local checkout, a single file/function, or a remote source (wp.org slug, GitHub URL).

Use when asked how long WordPress work will take, when sizing or scoping a ticket, or when planning a sprint — covering pure WordPress (PHP/theme/plugin) and the React surfaces of WordPress (Gutenberg blocks, Interactivity API, block themes, headless WP like Next.js / Faust). Triggers: "how long", "estimate", "how complex is this", "can we do this in a day", "is this a big task", "how should I scope this", "break this down", sprint planning, ticket sizing, story points, t-shirt sizing, project planning for WordPress or React-in-WP work. Do NOT use for generic standalone-React projects with no WordPress involvement.

Use when planning, sizing, or running a WordPress content migration — WP→WP (multisite consolidation, hosting move, theme replatform) or other-system→WP (Laravel, Drupal, static, proprietary CMS). Triggers: "WP migration", "WordPress migration", "content migration", "migrate to WordPress", "WP to WP migration", "Laravel to WordPress", "Drupal to WordPress", "import posts", "migrate attachments", "media migration", "migration runbook", "migration plugin", and any bulk wp_posts / wp_postmeta / wp_term_* transform.

Step-by-step instructions for deep analysis of a WordPress plugin — architecture, execution flows, hook chains, data lifecycle, and extensibility — from a local path or GitHub URL. Writes structured documentation into agent memory.