Wp Abilities Verify

Catches the security nightmare where a WordPress ability claims to be readonly but actually writes to the database. Runs in two modes: static analysis from source that scans callback bodies for write patterns, or runtime mode that spins up an environment and executes abilities against live WordPress. You'd use this before merging ability registrations or as a health check after refactors. Also validates audit documents from wp-abilities-audit, checks permission gates, and lints schemas. The adversarial annotation correctness check is the centerpiece here, because agents plan actions based on introspected annotations, so a lying readonly flag breaks both security and UX assumptions. Runtime mode adds idempotency verification via twin invocation heuristics.

Install to Claude Code

npx -y skills add wordpress/agent-skills --skill wp-abilities-verify --agent claude-code