wp-plugin-audit

Name: wp-plugin-audit
Author: mralaminahamed

25stars3forks

How to install wp-plugin-audit?

mralaminahamed/wp-dev-skills/wp-plugin-audit

$npx -y skills add mralaminahamed/wp-dev-skills --skill wp-plugin-audit

Installs into the current project.

Summary

Use when auditing a WordPress plugin for security issues, code inconsistencies, or quality gaps — fans out parallel checks across four dimensions: A (version/metadata sync), B (naming/prefix/i18n), C (docs vs code), D (code conventions/security), verifies every finding with file:

Files · 1

View on GitHub

SKILL.md

1	# WordPress Plugin Consistency Audit
2
3	Read-only audit that surfaces inconsistencies across a WP plugin's code, config, and docs. Optimised for recall with low false-positive rate: every candidate is verified against the actual code before it reaches the report.
4
5	## When to use
6
7	- "Audit the plugin", "find inconsistencies", "consistency/quality sweep".
8	- Before a release, or after a large refactor, to catch drift.
9
10	Not for: PHPStan type checking or baseline generation — use `wp-phpstan` (official). WP.org pre-submission review (17 rejection patterns) — use `wp-org-submission` which has that checklist.
11
12	## Method
13
14	### 1. Fan out — 4 independent dimensions (parallel agents)
15
16	Dispatch one read-only agent per dimension (`Explore` type, `model: haiku`), in a single message so they run concurrently. Each returns findings with `file:line`, the inconsistent value, and the expected/canonical form.
17
18	> Model note: Dimension agents are pure grep/read with no synthesis — `haiku` is faster and cheaper. The main thread (whatever model the user has active) does all verification and reporting.
19
20	- A — Version & metadata. Cross-reference every version/metadata source: plugin header (`Version`, `Requires at least`, `Requires PHP`, `Tested up to`, `Text Domain`), the version constant, `readme.txt` (`Stable tag` + Changelog + Upgrade Notice), `composer.json`, the `.pot` `Project-Id-Version`, and the schema/DB version. Flag every mismatch; note fields that are intentionally independent (schema `$db_version` ≠ plugin version) so they aren't flagged.
21
22	Also audit the main plugin file header format against the canonical PHPDoc DocBlock style (preferred over plain block comment):
23	```php
24	/**
25	* Plugin Name
26	*
27	* @package PluginPackage
28	* @author Your Name
29	* @copyright 2024 Your Name or Company Name
30	* @license GPL-2.0-or-later
31	*
32	* @wordpress-plugin
33	* Plugin Name: Plugin Name
34	* Plugin URI: https://example.com/plugin-name
35	* Description: Description of the plugin.
36	* Version: 1.0.0
37	* Requires at least: 6.5
38	* Requires PHP: 7.4
39	* Author: Your Name
40	* Author URI: https://example.com
41	* Text Domain: plugin-slug
42	* License: GPL v2 or later
43	* License URI: http://www.gnu.org/licenses/gpl-2.0.txt
44	* Update URI: https://example.com/my-plugin/
45	* Requires Plugins: my-plugin, yet-another-plugin
46	*/
47	```
48	Flag: missing `@wordpress-plugin` marker (distinguishes WP header from plain PHPDoc); missing `@package`/`@author`/`@copyright`/`@license` PHPDoc fields; `Description` over 140 characters; `License` slug not matching `License URI`; missing `Text Domain` when plugin has translated strings (requires Dimension B `__()` detection to confirm strings exist); using a plain `/* /` block instead of `/* */` PHPDoc block.
49
50	Version currency — WordPress and PHP baselines drift; re-verify against the live release each audit rather than trusting these numbers. As of July 2026: current WordPress stable is 7.0 (7.1 due Aug 2026; 6.9.x is the prior maintenance line); PHP floor is 7.4 (WP 7.0 dropped 7.2/7.3), officially recommended 8.3+; the WP.org directory has 18 numbered guidelines (page last updated 2026-03-11). Flag:
51	- a `Tested up to` that does NOT equal a real, released WordPress version. A value ahead of the latest release (e.g. `7.9` when 7.0 is current) is as wrong as a stale one — WP.org warns on both. **Verify against the current WP release befo

People who liked this also viewed

6 picks

Type

wp-plugin-audit

25stars3forks

View on GitHub

How to install wp-plugin-audit?

mralaminahamed/wp-dev-skills/wp-plugin-audit

$npx -y skills add mralaminahamed/wp-dev-skills --skill wp-plugin-audit

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# WordPress Plugin Consistency Audit
2
3	Read-only audit that surfaces inconsistencies across a WP plugin's code, config, and docs. Optimised for recall with low false-positive rate: every candidate is verified against the actual code before it reaches the report.
4
5	## When to use
6
7	- "Audit the plugin", "find inconsistencies", "consistency/quality sweep".
8	- Before a release, or after a large refactor, to catch drift.
9
10	Not for: PHPStan type checking or baseline generation — use `wp-phpstan` (official). WP.org pre-submission review (17 rejection patterns) — use `wp-org-submission` which has that checklist.
11
12	## Method
13
14	### 1. Fan out — 4 independent dimensions (parallel agents)
15
16	Dispatch one read-only agent per dimension (`Explore` type, `model: haiku`), in a single message so they run concurrently. Each returns findings with `file:line`, the inconsistent value, and the expected/canonical form.
17
18	> Model note: Dimension agents are pure grep/read with no synthesis — `haiku` is faster and cheaper. The main thread (whatever model the user has active) does all verification and reporting.
19
20	- A — Version & metadata. Cross-reference every version/metadata source: plugin header (`Version`, `Requires at least`, `Requires PHP`, `Tested up to`, `Text Domain`), the version constant, `readme.txt` (`Stable tag` + Changelog + Upgrade Notice), `composer.json`, the `.pot` `Project-Id-Version`, and the schema/DB version. Flag every mismatch; note fields that are intentionally independent (schema `$db_version` ≠ plugin version) so they aren't flagged.
21
22	Also audit the main plugin file header format against the canonical PHPDoc DocBlock style (preferred over plain block comment):
23	```php
24	/**
25	* Plugin Name
26	*
27	* @package PluginPackage
28	* @author Your Name
29	* @copyright 2024 Your Name or Company Name
30	* @license GPL-2.0-or-later
31	*
32	* @wordpress-plugin
33	* Plugin Name: Plugin Name
34	* Plugin URI: https://example.com/plugin-name
35	* Description: Description of the plugin.
36	* Version: 1.0.0
37	* Requires at least: 6.5
38	* Requires PHP: 7.4
39	* Author: Your Name
40	* Author URI: https://example.com
41	* Text Domain: plugin-slug
42	* License: GPL v2 or later
43	* License URI: http://www.gnu.org/licenses/gpl-2.0.txt
44	* Update URI: https://example.com/my-plugin/
45	* Requires Plugins: my-plugin, yet-another-plugin
46	*/
47	```
48	Flag: missing `@wordpress-plugin` marker (distinguishes WP header from plain PHPDoc); missing `@package`/`@author`/`@copyright`/`@license` PHPDoc fields; `Description` over 140 characters; `License` slug not matching `License URI`; missing `Text Domain` when plugin has translated strings (requires Dimension B `__()` detection to confirm strings exist); using a plain `/* /` block instead of `/* */` PHPDoc block.
49
50	Version currency — WordPress and PHP baselines drift; re-verify against the live release each audit rather than trusting these numbers. As of July 2026: current WordPress stable is 7.0 (7.1 due Aug 2026; 6.9.x is the prior maintenance line); PHP floor is 7.4 (WP 7.0 dropped 7.2/7.3), officially recommended 8.3+; the WP.org directory has 18 numbered guidelines (page last updated 2026-03-11). Flag:
51	- a `Tested up to` that does NOT equal a real, released WordPress version. A value ahead of the latest release (e.g. `7.9` when 7.0 is current) is as wrong as a stale one — WP.org warns on both. **Verify against the current WP release befo

People who liked this also viewed

6 picks

Type