Evidence record · captured 2026-10-11

WP-CLI Operations

Operational WordPress work through WP-CLI: safe search-replace for domain/protocol migrations, db export/import, plugin/theme/user management, cron, cache and rewrite flushing, multisite targeting (--url, --network) and wp-cli.yml automation. It requires the agent to establish environment (local/staging/production), site root and safety constraints before running write commands, with a dedicated safety reference.

Official publisherUnverifiedSource reviewedBehavior not tested

Source review

Editorial assessment

This is a source-only assessment. It does not claim runtime or security testing.

What it does

Puts a safety gate in front of WP-CLI operations: the agent must confirm the environment, the --path and --url target, and take a backup before writes, with search-replace always preceded by a db export and a dry run.

Best for

Domain or http-to-https migrations with wp search-replace
Multisite operations where a missing --url could hit the wrong site
Writing repeatable ops scripts and wp-cli.yml defaults for CI

Strengths in the source

The safety reference names high-risk commands (db reset, db import, search-replace, bulk deletes, mass production updates) that require explicit confirmation.
Fixes the search-replace sequence as db export, then --dry-run, then the real run, then cache and rewrite flushes.
wpcli_inspect.mjs reports WP-CLI availability, core version, multisite status and siteurl for the targeted path before anything changes.
Escalation rule is explicit: if environment safety cannot be confirmed, do not run write operations.

Limitations

Needs WP-CLI and database access on the target; the workflows it describes overwrite live data on real sites if run against production.
wpcli_inspect.mjs executes the wp binary against the site and accepts --allow-root, so it is a live command, not a static scan.
Per the repository README, the WordPress skills were generated with an AI model and then reviewed by WordPress contributors.

When not to use it

Sites where the agent cannot reach the intended command runner, such as a container or CI job it has no access to.
Code changes to plugins or themes, which the development skills in the same pack cover.

Reviewed by Retenta editorial on 2026-10-11; scope: source only.

Files included in this review

skills/wp-wpcli-and-ops/SKILL.md

Evidence and boundaries

Execution · not tested

Retenta has not executed this skill.

Security · not tested

Bundles 1 script (scripts/wpcli_inspect.mjs) that the agent may run. Retenta has not run them or scanned them.

Pinned publisher source: skills/wp-wpcli-and-ops/SKILL.md
Revision: 3cf7f6f701300d80166cc0b7e6ebc667501c353d
License evidence: GPL-2.0-or-laterRetenta preserves the license text captured with this immutable upstream snapshot; no independent legal or security review is claimed.
Last source change: 2026-07-08
Independent verification: Published by WordPress (WordPress.org contributors), but not independently verified by a third-party reviewer.
Upstream repository: Open publisher repository