Verifies a WordPress plugin's Abilities API registrations - the adversarial readonly-but-writes check, permission-gate and schema lints, and optional runtime execution against a live environment.
---
name: wp-abilities-verify
description: Verify a WordPress plugin's Abilities API registrations - enumerate abilities, check that callback behavior matches each annotation's claim (the adversarial readonly-but-writes detection), validate permissions and schemas, and validate audit documents. Targets WordPress 6.9+ plugins.
---
# WP Abilities Verify
Verify that a plugin's registered abilities actually behave as annotated. The centerpiece is the adversarial annotation-correctness check: a `readonly: true` ability that actually writes is a security/UX hazard because agents plan actions from the annotations they introspect.
## Workflow
1. Choose a mode - static (from the plugin checkout, no env) or runtime (requires a running env; adds authoritative enumeration and execution).
2. If an audit doc is provided, validate it against the canonical schema first.
3. Enumerate abilities statically via `wp_register_ability(` calls (use `rg --multiline --pcre2`); in runtime mode cross-check against `wp_get_abilities()` over wp-cli.
4. Run the adversarial correctness check: read each callback body and confirm `readonly`/`destructive`/`idempotent` claims match (no `$wpdb->update`, `update_option`, deletes, etc.).
5. Lint permission gates (prefer `current_user_can(...)`; fail literal `true`) and input schemas.
6. Emit a structured PASS/WARN/FAIL report; suppress false positives with `// verify-ignore:` comments.
Full skill & source: https://github.com/WordPress/agent-skills/tree/aa735ea7111c7924ee988306bcef70439e17dec9/skills/wp-abilities-verify