菜单
Systematic root-cause debugging for an EA widget. Use when a widget is reported broken, a fix didn't take effect, editor and frontend diverge, or asset/AJAX failures are suspected. Reproduce → localize → trace → fix-at-root → guard. Every step ends with a confirming signal — no guesses.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Audit and fix WordPress / WooCommerce plugins that leak password-protected post content through AJAX handlers or listing-widget queries. Catches the specific gap that `is_visible()` + `post_status === 'publish'` checks miss: password-protected posts keep `post_status='publish'`, so they bypass draft/private guards while their full content (title, price, SKU, description, permalink) is rendered to unauthenticated visitors. Use when a report mentions "password-protected product/post leak", "quickview exposure", "post_password not enforced", or whenever reviewing a `wp_ajax_nopriv_` endpoint that loads a single post's content, or any widget that builds a new `WP_Query` for a public listing.
Audit and fix WordPress AJAX handlers registered via wp_ajax_nopriv_* that build WP_Query args from client input. Catches the common pattern where a handler overrides post_status/post_type to 'any' (or trusts client-supplied post__in / author / meta_query) and ends up exposing private, draft, pending, future, trash, or auto-draft content to unauthenticated visitors. Use when reviewing or hardening any wp_ajax_nopriv_ endpoint, or when a report mentions "unauthenticated information disclosure" / "draft exposure" / "private post leak" in a WordPress plugin.
Ship a change via a feature branch and pull request — never directly to the default branch. Use after any code change, fix, refactor, or docs update that needs to land on main. Branches are named `<card-number>` from the FluentBoards card. Commits go through the husky pre-commit hook (lint-staged); pushes go to the feature branch only; the PR body links back to the card. Hard refuses any push to main / master / trunk.
Pre-flight checklist for shipping an EA Lite release to WordPress.org. Use when bumping a version, preparing a release branch, building a distribution zip, or before tagging. Walks through quality gates, version bump in three required files, changelog format, .distignore audit, and post-release verification. No phase is skippable — wordpress.org publishes whatever the Stable tag points to.
Scaffold a new Essential Addons widget end-to-end — gather requirements, generate PHP class, SCSS, optional JS, register in config.php, optional Pro upsell, build, and verify. Use when adding any new widget, even simple display ones. Outputs files that already follow EA conventions (text domain, BEM, Asset_Builder deps, render method) so the next session can start with controls + render logic, not boilerplate.
Design and audit Elementor controls for an EA widget. Use when adding controls to a new or existing widget, refactoring a messy `register_controls()`, deciding between control types, or wiring conditions, responsive, and selectors. Outputs control code that follows EA conventions and renders sensibly with default values.
| name | debug-widget |
| description | Systematic root-cause debugging for an EA widget. Use when a widget is reported broken, a fix didn't take effect, editor and frontend diverge, or asset/AJAX failures are suspected. Reproduce → localize → trace → fix-at-root → guard. Every step ends with a confirming signal — no guesses. |
npm run build or plugin updateWidget identifier · symptom (expected vs actual) · environment (frontend / editor / both, logged-in?) · recent changes (last commit, build, version bump). Missing input → ask, don't guess.
A bug you can't reproduce, you can't fix.
npx wp-env start if needed → open http://localhost:8888Narrow the failure surface before opening files.
Q1. Frontend / editor / both? → "editor only" → trace path: Editor-mismatch
Q2. Is `.eael-{slug}` HTML present? → no → trace path: Render
Q3. Are `{slug}.min.css/.min.js` loaded (Network tab)? → no → trace path: Asset
Q4. Console errors? → yes → trace path: JS init
AJAX 4xx/5xx? → yes → trace path: AJAX
No errors but visual still wrong → trace path: Visual/CSS
Each path ends with a confirming signal. Don't fix until the signal matches — if it doesn't, you're in the wrong path; re-localize.
| Path | Where to look | EA-specific gotcha | Confirming signal |
|---|---|---|---|
| Render | render() in includes/Elements/{Widget}.php; tail wp-content/debug.log (wp config set WP_DEBUG_LOG true) | Early-return on empty settings; PHP notice suppressing output | error-log line or specific failing if-branch |
| Asset | config.php slug entry; built file at assets/front-end/.../{slug}.min.{css,js}; Asset_Builder detection | Asset_Builder walks Elementor doc data — misses widgets inside templates, popups, global widgets, or shortcodes. Bump EAEL_PLUGIN_VERSION / regen Elementor CSS if cache stale | file 200 in Network OR identified gap (missing build, missing dep, missed detection context) |
| JS init | src/js/view/{slug}.js source (not .min.js) | Standard pattern: elementorFrontend.hooks.addAction("frontend/element_ready/eael-{slug}.default", Fn) guarded by eael.elementStatusCheck('eael{Slug}Load'). Common breaks: missing guard → double-init; vendor lib (Typed/Swiper/Morphext) load order in config.php deps; isEditMode code leaking to frontend | console error → file:line in source |
| AJAX | wp_ajax_* in includes/Traits/Ajax_Handler.php; Network → request payload + response | Security triad: check_ajax_referer() nonce + current_user_can() cap + sanitization. Most common: nonce mismatch (re-login) or wp_send_json_error() early on validation | matched handler with explicit failure reason |
| Editor-mismatch | Elementor::instance()->editor->is_edit_mode() branches; is_dynamic_content(); editor-only enqueue context in config.php | Edit-iframe preview uses different CSS/JS context than frontend | identified diverging conditional |
| Visual/CSS | DevTools Elements: classes match render()?; SCSS source rule exists?; grep rule in built .min.css (regen if missing); specificity vs theme/Elementor globals | Source rule present but build missing → npm run build | identified missing / overridden / wrong-selector rule |
Ask "why?" until the answer has no parent. A symptom-patch ships fast and breaks something else next week. If you can't reach a root cause in 5 levels of "why?", stop and report what you've narrowed — don't ship a guess.
npm run build if src/ was touched.tests/e2e/utils/seed.sh → write tests/e2e/specs/{widget-slug}-{bug-id}.spec.ts with one assertion that fails on broken code, passes on fixed → npm run test:e2e green.http://localhost:8888 with original repro steps. After cache clear / rebuild, also test in a private window (cold load).## Debug Report: {Widget} — {one-line symptom}
**Repro:** {steps}
**Root cause:** {one sentence — what was actually wrong}
**Fix:** {file}:{lines} — {one-sentence change}
**Guard:** {tests/e2e/specs/...} — {what it asserts}
**Verified on:** {browsers, URL, date}
**Out of scope (noted, not fixed):** {adjacent issues}