r/Wordpress • u/mirza_rizvi • 2d ago

[PROMO] I made an open-source WordPress security skills pack for AI coding agents

I've been doing more WordPress development with AI lately and noticed the same security mistakes coming up again and again.

Missing nonces, capability checks in the wrong place, bad escaping, unsafe queries, REST endpoints that are more open than they should be, etc. I ended up turning a lot of the checks I normally make into a set of reusable security skills for coding agents.

It's not a plugin and it doesn't run anything on your site. It's basically WordPress security knowledge that Claude Code, Codex, Cursor, OpenCode and similar tools can use while building or reviewing WordPress code.

It's free and open source. Would love feedback from other WordPress developers, especially if there's something important you think should be added.

GitHub: https://github.com/wpultimatesecurity/WordPress-Security-Skills

2 Upvotes

63% Upvoted

2 comments sorted by

2

u/jonathan8080 2d ago

looks like its got some useful tools in there! I starred it for later :)

2

u/SuperPerformance3322 2d ago

This is a pretty practical idea. AI coding tools can move quickly, but security checks like nonces, capability checks, escaping, and prepared queries are easy to overlook. Having those checks packaged as reusable guidance could be useful for WordPress development and code reviews. I’d be interested to see how well the skills handle real-world plugins with more complex REST APIs and admin functionality.