wp-plugin-review

Name: wp-plugin-review
Author: wpacademy

7installs17forks

How to install wp-plugin-review?

wpacademy/wordpress-dev-skills/wp-plugin-review

$npx -y skills add wpacademy/wordpress-dev-skills --skill wp-plugin-review

Installs into the current project.

Summary

Comprehensive WordPress plugin review covering security vulnerabilities, WordPress Coding Standards (WPCS) compliance, plugin repository guidelines, unit test coverage, and accessibility. Runs automated tools (PHPCS with WPCS, PHPStan, PHPUnit) plus deep manual code review. Outpu

Files · 1

View on GitHub

SKILL.md

1	# WordPress Plugin Review Skill
2
3	Review WordPress plugins for security, coding standards, repository guidelines, unit tests, and accessibility.
4	Produces a comprehensive Markdown report with findings, severity levels, and fix recommendations.
5
6	## Overview
7
8	This skill performs a two-phase review:
9
10	1. Automated Analysis — Install and run PHPCS (with WPCS rules), PHPStan, and PHPUnit
11	2. Manual Code Review — Deep inspection of security patterns, repo compliance, accessibility, and architecture
12
13	The final output is a structured Markdown report saved to `/mnt/user-data/outputs/`.
14
15	---
16
17	## Workflow
18
19	### Phase 0: Setup Environment
20
21	Run the setup script to install required tools:
22
23	```bash
24	bash scripts/setup_tools.sh
25	```
26
27	This installs PHPCS, WordPress Coding Standards, PHPStan, and PHPUnit if not already present.
28
29	### Phase 1: Locate the Plugin
30
31	1. Check `/mnt/user-data/uploads/` for uploaded plugin files (zip or folder)
32	2. If a zip file is found, extract it to `/home/claude/plugin-under-review/`
33	3. If a folder is found, copy it to `/home/claude/plugin-under-review/`
34	4. Identify the main plugin file (the one with the `Plugin Name:` header)
35
36	### Phase 2: Automated Analysis
37
38	Run the following tools and capture output:
39
40	#### PHPCS with WordPress Coding Standards
41	```bash
42	phpcs --standard=WordPress --extensions=php --report=json \
43	/home/claude/plugin-under-review/ > /home/claude/phpcs-report.json 2>&1
44	```
45
46	Also run with security-focused sniffs:
47	```bash
48	phpcs --standard=WordPress-Extra --extensions=php \
49	/home/claude/plugin-under-review/ 2>&1 \| head -200
50	```
51
52	#### PHPStan (Static Analysis)
53	```bash
54	phpstan analyse --level=5 --no-progress \
55	/home/claude/plugin-under-review/ 2>&1 \| head -200
56	```
57
58	#### PHPUnit (if tests exist)
59	Check for `tests/` directory or `phpunit.xml`. If found:
60	```bash
61	cd /home/claude/plugin-under-review && phpunit 2>&1 \| head -100
62	```
63
64	If no tests exist, note this as a finding in the report.
65
66	### Phase 3: Manual Code Review
67
68	Read `references/security-checklist.md` and `references/repo-guidelines-checklist.md` BEFORE starting the manual review.
69
70	For each PHP file in the plugin, review against ALL categories:
71
72	#### A. Security Review
73	Consult `references/security-checklist.md` for the full checklist. Key areas:
74
75	1. Input Sanitization — Every `$_GET`, `$_POST`, `$_REQUEST`, `$_SERVER`, `$_FILES` must be sanitized
76	2. Output Escaping — Every `echo`/`print` of dynamic data must use appropriate `esc_*()` functions
77	3. SQL Injection — All database queries must use `$wpdb->prepare()`
78	4. Nonce Verification — All form submissions and AJAX handlers must verify nonces
79	5. Capability Checks — All privileged actions must check `current_user_can()`
80	6. File Operations — File uploads must validate type/size and use WP filesystem API
81	7. CSRF Protection — State-changing requests must have nonce + referer checks
82	8. Data Validation — All data must be validated before processing
83	9. Direct File Access — All PHP files must prevent direct access (`defined('ABSPATH') \|\| exit`)
84	10. Secure API Calls — External HTTP requests must use `wp_remote_get/post()`
85
86	#### B. WordPress Coding Standards
87	1. Naming Conventions — Functions, classes, hooks follow WP naming patterns
88	2. File Organization — Proper directory structure and file naming
89	3. Hook Usage — Correct use of actions and filters
90	4. Enqueue Scripts/Styles — Must use `wp_enqueue_script/style()` with proper deps
91	5. Internationalization — All user-facing strings must use translation functions
92	6. PHP Compatibility — Must work with PHP 7.4+
93	7. WordPress API Usage — Use WP functions instead of raw PHP where available
94	8. No Bundled Core Libraries — Must not include jQuery, PHPMailer, etc.
95
96	#### C. Repository Guidelines
97	Consult `references/repo-guidelines-checklist.md` for full details. Key areas:
98
99	1. readme.txt — Proper format, required headers, changelog, FAQ
100	2. Plugin Headers — All required headers present and accurate
101	3. License — GPL-2.0-or-later compatible
102	4. No Tracking/Phoning Home — No unauthorized external calls
103	5. **No Obfuscated

People who liked this also viewed

6 picks

Type

wp-plugin-review

7installs17forks

View on GitHub

How to install wp-plugin-review?

wpacademy/wordpress-dev-skills/wp-plugin-review

$npx -y skills add wpacademy/wordpress-dev-skills --skill wp-plugin-review

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# WordPress Plugin Review Skill
2
3	Review WordPress plugins for security, coding standards, repository guidelines, unit tests, and accessibility.
4	Produces a comprehensive Markdown report with findings, severity levels, and fix recommendations.
5
6	## Overview
7
8	This skill performs a two-phase review:
9
10	1. Automated Analysis — Install and run PHPCS (with WPCS rules), PHPStan, and PHPUnit
11	2. Manual Code Review — Deep inspection of security patterns, repo compliance, accessibility, and architecture
12
13	The final output is a structured Markdown report saved to `/mnt/user-data/outputs/`.
14
15	---
16
17	## Workflow
18
19	### Phase 0: Setup Environment
20
21	Run the setup script to install required tools:
22
23	```bash
24	bash scripts/setup_tools.sh
25	```
26
27	This installs PHPCS, WordPress Coding Standards, PHPStan, and PHPUnit if not already present.
28
29	### Phase 1: Locate the Plugin
30
31	1. Check `/mnt/user-data/uploads/` for uploaded plugin files (zip or folder)
32	2. If a zip file is found, extract it to `/home/claude/plugin-under-review/`
33	3. If a folder is found, copy it to `/home/claude/plugin-under-review/`
34	4. Identify the main plugin file (the one with the `Plugin Name:` header)
35
36	### Phase 2: Automated Analysis
37
38	Run the following tools and capture output:
39
40	#### PHPCS with WordPress Coding Standards
41	```bash
42	phpcs --standard=WordPress --extensions=php --report=json \
43	/home/claude/plugin-under-review/ > /home/claude/phpcs-report.json 2>&1
44	```
45
46	Also run with security-focused sniffs:
47	```bash
48	phpcs --standard=WordPress-Extra --extensions=php \
49	/home/claude/plugin-under-review/ 2>&1 \| head -200
50	```
51
52	#### PHPStan (Static Analysis)
53	```bash
54	phpstan analyse --level=5 --no-progress \
55	/home/claude/plugin-under-review/ 2>&1 \| head -200
56	```
57
58	#### PHPUnit (if tests exist)
59	Check for `tests/` directory or `phpunit.xml`. If found:
60	```bash
61	cd /home/claude/plugin-under-review && phpunit 2>&1 \| head -100
62	```
63
64	If no tests exist, note this as a finding in the report.
65
66	### Phase 3: Manual Code Review
67
68	Read `references/security-checklist.md` and `references/repo-guidelines-checklist.md` BEFORE starting the manual review.
69
70	For each PHP file in the plugin, review against ALL categories:
71
72	#### A. Security Review
73	Consult `references/security-checklist.md` for the full checklist. Key areas:
74
75	1. Input Sanitization — Every `$_GET`, `$_POST`, `$_REQUEST`, `$_SERVER`, `$_FILES` must be sanitized
76	2. Output Escaping — Every `echo`/`print` of dynamic data must use appropriate `esc_*()` functions
77	3. SQL Injection — All database queries must use `$wpdb->prepare()`
78	4. Nonce Verification — All form submissions and AJAX handlers must verify nonces
79	5. Capability Checks — All privileged actions must check `current_user_can()`
80	6. File Operations — File uploads must validate type/size and use WP filesystem API
81	7. CSRF Protection — State-changing requests must have nonce + referer checks
82	8. Data Validation — All data must be validated before processing
83	9. Direct File Access — All PHP files must prevent direct access (`defined('ABSPATH') \|\| exit`)
84	10. Secure API Calls — External HTTP requests must use `wp_remote_get/post()`
85
86	#### B. WordPress Coding Standards
87	1. Naming Conventions — Functions, classes, hooks follow WP naming patterns
88	2. File Organization — Proper directory structure and file naming
89	3. Hook Usage — Correct use of actions and filters
90	4. Enqueue Scripts/Styles — Must use `wp_enqueue_script/style()` with proper deps
91	5. Internationalization — All user-facing strings must use translation functions
92	6. PHP Compatibility — Must work with PHP 7.4+
93	7. WordPress API Usage — Use WP functions instead of raw PHP where available
94	8. No Bundled Core Libraries — Must not include jQuery, PHPMailer, etc.
95
96	#### C. Repository Guidelines
97	Consult `references/repo-guidelines-checklist.md` for full details. Key areas:
98
99	1. readme.txt — Proper format, required headers, changelog, FAQ
100	2. Plugin Headers — All required headers present and accurate
101	3. License — GPL-2.0-or-later compatible
102	4. No Tracking/Phoning Home — No unauthorized external calls
103	5. **No Obfuscated

People who liked this also viewed

6 picks

Type