Evidence record · captured 2026-10-11

WordPress Plugin Development

Guides plugin architecture and hooks, activation/deactivation/uninstall, the Settings API and admin UI, data storage and cron, release packaging, and security fundamentals (nonces, capability checks, sanitization/escaping, $wpdb->prepare). It starts with a triage script to locate plugin entrypoints and asks for target WP/PHP versions and single-site vs multisite.

Official publisherUnverifiedSource reviewedBehavior not tested

Source review

Editorial assessment

This is a source-only assessment. It does not claim runtime or security testing.

What it does

Gives the agent a plugin-specific checklist that treats security as a standing baseline: nonce plus capability check, sanitize early, escape late, prepared SQL. It also asks for target WP/PHP versions and multisite status before any code changes.

Best for

Reviewing a plugin's admin forms and AJAX handlers for missing capability checks or unescaped output
Adding a settings page through the Settings API with a sanitize_callback
Writing activation, deactivation and uninstall logic that does not misfire or remove the wrong data

Strengths in the source

States that nonces prevent CSRF but do not authorize, and requires pairing them with current_user_can checks.
The security reference maps each output context to its escaping function (esc_html, esc_attr, esc_url, esc_textarea, esc_js).
Lifecycle guardrails are specific: register activation hooks at top level and flush rewrite rules only after registering CPTs.
Ships detect_plugins.mjs, a read-only scan that finds plugin main files by header, so full-site repos get an explicit target.

Limitations

Like the other WordPress pack skills, its triage step depends on detect_wp_project.mjs from the separate wp-project-triage skill.
Guidance is principle-level with short references; it defers to the Plugin Handbook for canonical detail rather than covering edge cases.
Targets WordPress 7.0+ and PHP 7.4+ per its compatibility field, so older sites need the version caveats checked by hand.

When not to use it

Building REST endpoints, which the dedicated wp-rest-api skill covers in more depth.
Block registration and editor code inside a plugin, where wp-block-development applies.

Reviewed by Retenta editorial on 2026-10-11; scope: source only.

Files included in this review

skills/wp-plugin-development/SKILL.md

Evidence and boundaries

Execution · not tested

Retenta has not executed this skill.

Security · not tested

Bundles 1 script (scripts/detect_plugins.mjs) that the agent may run. Retenta has not run them or scanned them.

Pinned publisher source: skills/wp-plugin-development/SKILL.md
Revision: 3cf7f6f701300d80166cc0b7e6ebc667501c353d
License evidence: GPL-2.0-or-laterRetenta preserves the license text captured with this immutable upstream snapshot; no independent legal or security review is claimed.
Last source change: 2026-07-08
Independent verification: Published by WordPress (WordPress.org contributors), but not independently verified by a third-party reviewer.
Upstream repository: Open publisher repository