# Wp Guard

Review generated or changed WordPress code, plugins, themes, and blocks, before it...

- Repository: https://github.com/amElnagdy/guard-skills (1302 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-07-04
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add amElnagdy/guard-skills --skill wp-guard -g -a claude-code -y`
Codex: `npx skills add amElnagdy/guard-skills --skill wp-guard -g -a codex -y`
Cursor: `npx skills add amElnagdy/guard-skills --skill wp-guard -g -a cursor -y`
Gemini CLI: `npx skills add amElnagdy/guard-skills --skill wp-guard -g -a gemini-cli -y`

## Description

Review generated or changed WordPress code, plugins, themes, and blocks, before it ships. Best used reactively after an agent writes, edits, or reviews code touching WordPress APIs: add_action/add_filter, shortcodes, meta boxes, AJAX handlers, REST routes, WP_Query or $wpdb, widgets, or WP-CLI commands. Use on 'review this plugin', 'is this safe to ship', 'make this translatable', 'speed up this query', or after tasks like 'write a plugin' or 'add an endpoint/shortcode/meta box'. Enforces escaping and sanitization, nonces plus capability checks, prepared database queries, core-API-first development, translation-ready strings, and query/caching discipline. DO NOT USE for WooCommerce-specific order, product, or checkout logic (use woo-guard), non-WordPress PHP, generic code quality review (use clean-code-guard), test code review (use test-guard), server or hosting configuration, or conceptual WordPress questions.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# WP Guard

You are reviewing generated or changed WordPress code before it ships. Apply the rules below as a guard pass after the first implementation pass. Be a sharp reviewer, not a pedantic one: flag what creates vulnerabilities, breaks translations, or melts servers, ignore cosmetic preferences WPCS tooling already handles.

These rules exist because AI agents produce WordPress code with systematic failures: raw `echo` of request data, AJAX handlers with neither nonce nor capability check, SQL built by string interpolation, English hardcoded into user-facing strings, `posts_per_page => -1` on sites with a million posts, and hand-rolled replacements for APIs core already ships. Each one looks fine in a demo and fails in production.

## How to use this skill

**Guard-pass mode** (recommended): after WordPress code has been generated or edited, apply the rules to the diff or target files, then run the self-check before delivery. Fix violations before showing the user.

**Live mode** (explicit): when the user invokes this skill before writing WordPress code, apply the same rules while writing, then run the self-check before delivery.

**Review mode** (the user asks you to review, audit, or rate WordPress code): walk [references/review-checklist.md](references/review-checklist.md) against the target files and produce a structured findings report. Do not edit code in review mode unless asked.

Pair this skill with clean-code-guard when both are installed: clean-code-guard owns generic code quality; wp-guard owns the WordPress layer.

## Adapt to the project first

The rest: https://github.com/amElnagdy/guard-skills/blob/HEAD/skills/wp-guard/SKILL.md