# wp-abilities-verify

Verifies WordPress plugin Abilities API registrations, flags hidden database writes in readonly callbacks, and validates schemas.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 2600 installs · ★ 2298
- Author: WordPress
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/WordPress/agent-skills/tree/HEAD/skills/wp-abilities-verify/SKILL.md
- Updated: 2026-10-21
- HTML: https://affpapa.org/en/nevibecode/skills/wp-abilities-verify

## What it does

The skill audits Abilities API registrations in WordPress plugins. Its main focus is spotting contradictions between annotations and actual code. When a callback is marked as `readonly: true` but calls `$wpdb->update` or modifies settings via `update_option`, the audit flags a failure. It also monitors `destructive: false` flags and validates schema constraints.

Verification runs in two modes. Static mode works directly from the repository without a live WordPress instance. It enumerates registrations with `rg` and inspects callbacks. Runtime mode needs a working container such as `wp-env`. In this mode, the agent queries `wp_get_abilities()` and tests callbacks against active user roles.

A clean report in static mode means the code shape matches expectations, but it does not prove that writes never happen. Because of hidden side effects, you should run runtime checks before merging pull requests in production plugins. Prerequisites include running `wp-project-triage` beforehand and having at least one call to `wp_register_ability`.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add WordPress/agent-skills --skill wp-abilities-verify -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/wp-abilities-verify/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/wp-abilities-verify/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add WordPress/agent-skills --skill wp-abilities-verify -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/wp-abilities-verify/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add WordPress/agent-skills --skill wp-abilities-verify -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/wp-abilities-verify/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install WordPress/agent-skills wp-abilities-verify
```

2. **Manually: put the files in place**
- File: `.github/skills/wp-abilities-verify/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add WordPress/agent-skills --skill wp-abilities-verify -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/WordPress/agent-skills --path skills/wp-abilities-verify
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/wp-abilities-verify/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add WordPress/agent-skills --skill wp-abilities-verify -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/WordPress/agent-skills/tree/HEAD/skills/wp-abilities-verify/SKILL.md

## When to use it
- detect hidden database writes in callbacks marked as readonly
- validate access restrictions defined in permission_callback
- catch schema formatting errors before opening a pull request
- verify audit documentation against registered abilities in code

## Example prompts
- Run a static verification of registered abilities in this WordPress plugin and write the report to `reports/abilities.md`
- Check all readonly annotations and parameter schemas in the plugin using wp-abilities-verify
- Execute wp-abilities-verify in runtime mode using `npm run wp-env start` to bring up the test stack

## Similar
- [wordpress-pro](https://affpapa.org/en/nevibecode/skills/wordpress-pro.md) — skill · 9700 installs
- [wp-guard](https://affpapa.org/en/nevibecode/skills/wp-guard.md) — skill · 2600 installs
- [woocommerce-code-review](https://affpapa.org/en/nevibecode/skills/woocommerce-code-review.md) — skill · 1800 installs
- [woo-guard](https://affpapa.org/en/nevibecode/skills/woo-guard.md) — skill · 2500 installs
- [wordpress](https://affpapa.org/en/nevibecode/skills/wordpress.md) — skill · 894 installs
- [wordpress-security-validation](https://affpapa.org/en/nevibecode/skills/wordpress-security-validation.md) — skill · 581 installs

From the same set: [wordpress/agent-skills](https://affpapa.org/en/nevibecode/by/wordpress/agent-skills.md) — 19 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md