wp-abilities-verify — Claude Code skill: what it does, how to install
Verifies WordPress plugin Abilities API registrations, flags hidden database writes in readonly callbacks, and validates schemas.
npx skills add WordPress/agent-skills --skill wp-abilities-verify -a claude-codeWhat wp-abilities-verify does
The skill audits Abilities API registrations in WordPress plugins. Its main focus is spotting contradictions between annotations and actual code. When a callback is marked as readonly: true but calls $wpdb->update or modifies settings via update_option, the audit flags a failure. It also monitors destructive: false flags and validates schema constraints.
Verification runs in two modes. Static mode works directly from the repository without a live WordPress instance. It enumerates registrations with rg and inspects callbacks. Runtime mode needs a working container such as wp-env. In this mode, the agent queries wp_get_abilities() and tests callbacks against active user roles.
A clean report in static mode means the code shape matches expectations, but it does not prove that writes never happen. Because of hidden side effects, you should run runtime checks before merging pull requests in production plugins. Prerequisites include running wp-project-triage beforehand and having at least one call to wp_register_ability.
What it helps with
- detect hidden database writes in callbacks marked as readonly
- validate access restrictions defined in permission_callback
- catch schema formatting errors before opening a pull request
- verify audit documentation against registered abilities in code
Example prompts for the agent
- Run a static verification of registered abilities in this WordPress plugin and write the report to
reports/abilities.md - Check all readonly annotations and parameter schemas in the plugin using wp-abilities-verify
- Execute wp-abilities-verify in runtime mode using
npm run wp-env startto bring up the test stack
How to install wp-abilities-verify
1Skills CLI (Vercel)
npx skills add WordPress/agent-skills --skill wp-abilities-verify -a claude-code2Manually: put the files in place
~/.claude/skills/wp-abilities-verify/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/wp-abilities-verify/
1Skills CLI (Vercel)
npx skills add WordPress/agent-skills --skill wp-abilities-verify -a codex2Manually: put the files in place
.agents/skills/wp-abilities-verify/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add WordPress/agent-skills --skill wp-abilities-verify -a cursor2Manually: put the files in place
.cursor/skills/wp-abilities-verify/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install WordPress/agent-skills wp-abilities-verify2Manually: put the files in place
.github/skills/wp-abilities-verify/SKILL.md1Skills CLI (Vercel)
npx skills add WordPress/agent-skills --skill wp-abilities-verify -a gemini-cli2Platform CLI
gemini skills install https://github.com/WordPress/agent-skills --path skills/wp-abilities-verifyManually: put the files in place
.devin/skills/wp-abilities-verify/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add WordPress/agent-skills --skill wp-abilities-verify -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about wp-abilities-verify
How to install wp-abilities-verify in Claude Code?
Run npx skills add WordPress/agent-skills --skill wp-abilities-verify -a claude-code in your terminal. Once added, the skill becomes available to the agent in your project.
What does wp-abilities-verify do?
It checks Abilities API registrations in WordPress plugins against their annotations. The skill detects methods marked as readonly that still modify options or database records, and inspects permission callbacks alongside JSON schemas.
What is the difference between static and runtime modes?
Static mode inspects plugin source code without spinning up a WordPress environment to spot obvious contract violations. Runtime mode requires a live environment like wp-env or Docker to execute callbacks with test users and check for actual idempotency.
