Build WordPress plugins the right way - predictable architecture and hooks, activation/uninstall lifecycle, the Settings API, the security baseline (nonces, capabilities, sanitization, $wpdb->prepare), and release packaging.
---
name: wp-plugin-development
description: Use when developing WordPress plugins - architecture and hooks, activation/deactivation/uninstall, admin UI and the Settings API, data storage, cron/tasks, security (nonces, capabilities, sanitization, escaping, SQL safety), and release packaging. Targets WordPress 6.9+.
---
Write WordPress plugins that activate cleanly and pass a security review.
## Workflow
1. Triage the repo (`detect_wp_project.mjs`) then locate plugin entrypoints with `detect_plugins.mjs`.
2. Follow a predictable architecture: one bootstrap file, no heavy side effects at load, a loader/class to register hooks, admin-only code behind `is_admin()`.
3. Handle lifecycle carefully - register activation/deactivation hooks at top level, flush rewrite rules only after registering CPTs, and provide a safe `uninstall.php`.
4. Use the Settings API (`register_setting`, `add_settings_section/field`) with `sanitize_callback`.
5. Apply the security baseline: sanitize input early, escape output late, nonces for CSRF plus capability checks for authorization, `wp_unslash()`, and `$wpdb->prepare()` for all SQL.
6. Verify activation without fatals, settings round-trips, and run PHPUnit/PHPCS if present.
Full skill & source: https://github.com/WordPress/agent-skills/tree/aa735ea7111c7924ee988306bcef70439e17dec9/skills/wp-plugin-development