Claude Code, Plugin
Wp Dev Skills
WordPress plugin development skills for AI coding agents — Claude Code, Gemini CLI, Cursor, Windsurf, Cline, Codex, Copilot, opencode, and more
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 762b7bc76443, unchanged since the check below.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
skills/wp-admin-browser/SKILL.md, line 31
// POST to wp-login.php via fetch (fastest, no UI needed for login itself)
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. accepts a host from input, with no fixed list in this file. can reach example.com. The description does not name that host. can reach api.wordpress.org. The description does not name that host. can reach downloads.wordpress.org. The description does not name that host. can reach packagist.org. The description does not name that host.
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
skills/wp-admin-browser/SKILL.md, line 31
// POST to wp-login.php via fetch (fastest, no UI needed for login itself)
skills/wp-admin-browser/SKILL.md, line 33
const res = await fetch('/wp-login.php', {
skills/wp-admin-browser/SKILL.md, line 84
return fetch('/wp-admin/admin-ajax.php?action=rest-nonce', {
Show more
skills/wp-admin-browser/SKILL.md, line 219
const res = await fetch('/wp-login.php', {
skills/wp-admin-browser/references/browser-debug-patterns.md, line 49
const r = await fetch('/wp-json/wp/v2/settings', {
skills/wp-admin-browser/references/chrome-devtools-tools.md, line 61
return fetch('/wp-admin/admin-ajax.php?action=rest-nonce', {
skills/wp-admin-browser/references/chrome-devtools-tools.md, line 70
const nonce = await fetch('/wp-admin/admin-ajax.php?action=rest-nonce', {credentials:'
skills/wp-admin-browser/references/chrome-devtools-tools.md, line 71
const res = await fetch('/wp-json/my-plugin/v1/items?per_page=5', {
skills/wp-i18n-workflow/references/pot-commands.md, line 159
curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
skills/wp-plugin-release/references/svn-deploy.md, line 171
.env
skills/wp-plugin-audit/references/security.md, line 69
- Secrets committed to version control (`.env` without `.gitignore`, `config.php` tracked)
skills/wp-plugin-release/references/svn-deploy.md, line 170
webpack.config.js
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 762b7bc76443. can reach a host that is not written as a fixed address. accepts a host from input, with no fixed list in this file. can reach example.com. The description does not name that host. can reach api.wordpress.org. The description does not name that host. can reach downloads.wordpress.org. The description does not name that host. can reach packagist.org. The description does not name that host. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 762b7bc76443c7103623d11322a250910dfd8326
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.