# Wp Abilities Audit

Audit a WordPress plugin's REST surface and produce a standardized audit document...

- Repository: https://github.com/WordPress/agent-skills (2319 stars)
- Category: AI and agents
- License: see repository
- Last updated: 2026-10-26
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add WordPress/agent-skills --skill wp-abilities-audit -g -a claude-code -y`
Codex: `npx skills add WordPress/agent-skills --skill wp-abilities-audit -g -a codex -y`
Cursor: `npx skills add WordPress/agent-skills --skill wp-abilities-audit -g -a cursor -y`
Gemini CLI: `npx skills add WordPress/agent-skills --skill wp-abilities-audit -g -a gemini-cli -y`

## Description

Audit a WordPress plugin's REST surface and produce a standardized audit document proposing Abilities API registrations. Produces a markdown doc with a YAML schema and prose sections that humans and agents can both consume when planning a registration rollout. Works on any WP plugin.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# WP Abilities Audit

Produce a standardized audit document for a WordPress plugin's REST surface,
proposing a set of Abilities API registrations grouped by semantic intent. The
audit doc is a planning artifact for implementers, humans, agents, or both, that captures the controller inventory, capability gates, and proposed
ability shapes in a structured form. A reviewer reading the doc can scope the
work without re-deriving the survey.

This skill works on any plugin that exposes a REST surface. Plugin
classification (for purposes of the optional `plugin_family` annotation) is
the user's call; the workflow itself is plugin-agnostic.

## When to use

- The task is "register Abilities API abilities for a WP plugin" and no audit
  doc exists yet.
- Planning participation in a multi-plugin abilities rollout and need a
  shareable, standardized audit artifact.
- Pre-flight checking a plugin's agent-readiness before implementing abilities.
- A PM or non-implementer wants to scope the work before engineering picks it up.

## Inputs required

1. **Plugin checkout path**, working tree of the plugin to audit.
2. **Triage output**, run `wp-project-triage` first if not already done. The
   audit consumes `signals.usesAbilitiesApi`, `versions.wordpress`, and
   `project.kind` from the report.
3. **Auditor identity**, name and team or context, recorded in the audit's
   `auditor` field.
4. **Output path**, where the audit doc should land. Default explicit over
   implicit; ask if not provided rather than writing into the plugin worktree.

## Prerequisites

- `wp-project-triage` has run successfully and classified the plugin.
- The plugin has at least one REST controller. If enumeration finds zero
  controllers, the audit doesn't apply, see "Failure modes" below.

## Procedure

### 1. Enumerate REST controllers

The rest: https://github.com/WordPress/agent-skills/blob/HEAD/skills/wp-abilities-audit/SKILL.md