Wp REST API Development

What it does

When your agent uses it

• Reviewing custom REST routes
• Permissioncallback logic
• WPRESTRequest handling
• Response structure

Example prompts

• “REST API review”
• “registerrestroute”
• “permissioncallback”
• “/wp-rest-api-development”

Workflow steps

6 steps, taken from the first numbered list in SKILL.md.

1. 1Identify REST context
2. 2Check route registration first
3. 3Review request handling
4. 4Review response design
5. 5Check for CRITICAL/WARNING/INFO patterns
6. 6Report with cross-references

What it can do on your machine

Read from SKILL.md and the folder at commit 8c96442. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • rg

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Wp REST API Development loads about 1.4k tokens when it runs, and up to ~1.9k if it reads all its reference files. Until then it costs about 154 tokens; SKILL.md has 494 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~154

When it runs · the whole SKILL.md, loaded when a task matches

~1.4k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~1.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from jorgerosal/wordpress-skills at commit 8c96442, republished under its MIT licence (© jorgerosal). 494 words, ~1,449 tokens.

name

wp-rest-api-development

description

WordPress REST API review and development guidance. Use when reviewing custom REST routes, permission_callback logic, schema design, WP_REST_Request handling, response structure, versioning, controller classes, nonce or auth usage, or when user mentions "REST API review", "register_rest_route", "permission_callback", "WP_REST_Request", "REST endpoint", "custom API", "API schema", "REST controller", "headless WordPress", or "API auth". Detects route registration issues, authorization mistakes, schema drift, input validation gaps, and response design problems in WordPress REST API code.

# register_rest_route candidates
rg -n "register_rest_route\s*\(" . -g '*.php'

# permission_callback returning true
rg -n "permission_callback.*__return_true" . -g '*.php'

# Raw superglobals inside REST callbacks
rg -n "\$_GET|\$_POST|\$_REQUEST" . -g '*.php'

# WP_REST_Request usage without obvious validation helpers
rg -n "WP_REST_Request|get_param\s*\(" . -g '*.php'

# REST callbacks using wp_send_json
rg -n "wp_send_json|wp_send_json_success|wp_send_json_error" . -g '*.php'

# Route namespaces to inspect for versioning
rg -n "register_rest_route\s*\(\s*['\"][^'\"]+" . -g '*.php'

# WP_REST_Controller classes
rg -n "extends\s+WP_REST_Controller" . -g '*.php'

# rest_ensure_response usage
rg -n "rest_ensure_response|new\s+WP_REST_Response" . -g '*.php'

© jorgerosal, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 2 other files (references) in claude-skills/wp-rest-api-development of jorgerosal/wordpress-skills.

• SKILL.md
• references/route-patterns.md
• references/schema-and-auth-guide.md

Open the folder on GitHubat commit 8c96442