Agent skill

Wordpress Compliance

A skill your agent uses when modifying templates, admin UI, output, hooks, plugin metadata, sanitization, escaping, or any code that must remain compliant with WordPress.org and repository PHPCS…

GPL-2.0Auto-check passed

Install Wordpress Compliance

skills CLI

$ npx skills add wp-media/wp-rocket --skill wordpress-compliance -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install wp-media/wp-rocket wordpress-compliance --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/wp-media/wp-rocket.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/wordpress-compliance .claude/skills/wordpress-compliance && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "wordpress-compliance" agent skill from https://github.com/wp-media/wp-rocket/tree/develop/.claude/skills/wordpress-compliance into .claude/skills/wordpress-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "wordpress-compliance", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/wp-media/wp-rocket/tree/develop/.claude/skills/wordpress-compliance

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add wp-media/wp-rocket --skill wordpress-compliance -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install wp-media/wp-rocket wordpress-compliance --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/wp-media/wp-rocket.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.claude/skills/wordpress-compliance .agents/skills/wordpress-compliance && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "wordpress-compliance" agent skill from https://github.com/wp-media/wp-rocket/tree/develop/.claude/skills/wordpress-compliance into .agents/skills/wordpress-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "wordpress-compliance", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add wp-media/wp-rocket --skill wordpress-compliance -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install wp-media/wp-rocket wordpress-compliance --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/wp-media/wp-rocket.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.claude/skills/wordpress-compliance .cursor/skills/wordpress-compliance && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "wordpress-compliance" agent skill from https://github.com/wp-media/wp-rocket/tree/develop/.claude/skills/wordpress-compliance into .cursor/skills/wordpress-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "wordpress-compliance", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/wp-media/wp-rocket.git --path .claude/skills/wordpress-compliance

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add wp-media/wp-rocket --skill wordpress-compliance -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install wp-media/wp-rocket wordpress-compliance --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/wp-media/wp-rocket.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.claude/skills/wordpress-compliance .gemini/skills/wordpress-compliance && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "wordpress-compliance" agent skill from https://github.com/wp-media/wp-rocket/tree/develop/.claude/skills/wordpress-compliance into .gemini/skills/wordpress-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "wordpress-compliance", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install wp-media/wp-rocket wordpress-compliance

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add wp-media/wp-rocket --skill wordpress-compliance -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/wp-media/wp-rocket.git skills-src && mkdir -p .github/skills && cp -r skills-src/.claude/skills/wordpress-compliance .github/skills/wordpress-compliance && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "wordpress-compliance" agent skill from https://github.com/wp-media/wp-rocket/tree/develop/.claude/skills/wordpress-compliance into .github/skills/wordpress-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "wordpress-compliance", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add wp-media/wp-rocket --skill wordpress-compliance -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install wp-media/wp-rocket wordpress-compliance --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/wp-media/wp-rocket.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.claude/skills/wordpress-compliance .opencode/skills/wordpress-compliance && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "wordpress-compliance" agent skill from https://github.com/wp-media/wp-rocket/tree/develop/.claude/skills/wordpress-compliance into .opencode/skills/wordpress-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "wordpress-compliance", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: wordpress-compliance
GitHub stars: 767
Token cost: ~809 tokens
SKILL.md length: 278 words
Files: 1
Skills in repo: 15
Repo updated: Oct 7, 2026
First seen: Oct 7, 2026
Licence: GPL-2.0

At a glance

A skill your agent uses when modifying templates, admin UI, output, hooks, plugin metadata, sanitization, escaping, or any code that must remain compliant with WordPress.org and repository PHPCS…

Modifying templates
SKILL.md covers Responsibilities, Escaping heuristics, Text domain and Custom capabilities, plus 4 more sections
Calls git
Plugin metadata

What it does

Wordpress Compliance is an agent skill from wp-media/wp-rocket. Use this skill when modifying templates, admin UI, output, hooks, plugin metadata, sanitization, escaping, or any code that must remain compliant with WordPress.org and repository PHPCS rules.

Its SKILL.md is about 810 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It works with WordPress and PHP. The repository describes itself as: Performance optimization plugin for WordPress. The licence is GPL-2.0.

When your agent uses it

Modifying templates
Plugin metadata
Any code that must remain compliant with WordPress.org and repository PHPCS rules

Example prompts

“/wordpress-compliance”

What it can do on your machine

Read from SKILL.md and the folder at commit 3a96b66. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- git
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use git, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Wordpress Compliance loads about 809 tokens when it runs. Until then it costs about 53 tokens; SKILL.md has 278 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~53
When it runs · the whole SKILL.md, loaded when a task matches: ~809

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from wp-media/wp-rocket at commit 3a96b66, republished under its GPL-2.0 licence (© wp-media). 278 words, ~809 tokens.

Download SKILL.mdSave it as .claude/skills/wordpress-compliance/SKILL.md (or your agent's skills folder).

name: wordpress-compliance
description: Use this skill when modifying templates, admin UI, output, hooks, plugin metadata, sanitization, escaping, or any code that must remain compliant with WordPress.org and repository PHPCS rules.

WordPress Compliance

Ensure compatibility with:

WordPress Plugin Check
Repository PHPCS rules
WordPress.org expectations

Responsibilities

Respect repository PHPCS configuration.
Follow WordPress escaping standards.
Avoid forbidden or deprecated APIs.
Avoid direct access to superglobals without sanitization.
Ensure output is escaped for context.

Escaping heuristics

HTML text: esc_html() HTML attribute: esc_attr() URL: esc_url() Allowed HTML: wp_kses_post()

Text domain

WP Rocket uses the text domain rocket.

php

esc_html__( 'Clear Cache', 'rocket' )
esc_attr__( 'WP Rocket Settings', 'rocket' )

Custom capabilities

WP Rocket registers custom capabilities. Always use these (not manage_options) for capability checks. PHPCS is configured to allow them without warnings:

php

current_user_can( 'rocket_manage_options' )        // general plugin management
current_user_can( 'rocket_purge_cache' )            // clear/purge cache
current_user_can( 'rocket_preload_cache' )          // preload cache
current_user_can( 'rocket_remove_unused_css' )      // RUCSS
current_user_can( 'rocket_regenerate_critical_css' ) // critical CSS
current_user_can( 'rocket_purge_cloudflare_cache' ) // Cloudflare
current_user_can( 'rocket_purge_sucuri_cache' )     // Sucuri
current_user_can( 'rocket_purge_posts' )
current_user_can( 'rocket_purge_terms' )
current_user_can( 'rocket_purge_users' )

Using manage_options directly for WP Rocket–specific actions is incorrect and will flag in code review.

JavaScript

Do not use jQuery. Use native DOM APIs (document.querySelector, addEventListener, fetch, etc.).
jQuery is available in WordPress but its use introduces an unnecessary dependency and conflicts with modern bundling practices.

Anti-patterns

Echoing raw variables
Introducing unescaped output
Storing sensitive values in plain text
Writing files containing secrets/credentials (API keys, tokens, license data) to a path under wp-content/ without a real access-control mechanism. .htaccess deny alone does not block Nginx, and an index.php stub in the directory does not block direct requests to sibling static files (both web servers serve those straight from disk, bypassing PHP entirely) — neither is sufficient by itself. Store the data outside the web-served tree, or serve it only through an authenticated PHP handler (e.g. an admin-ajax/REST callback gated by current_user_can()) instead of a directly fetchable static file
Bypassing repository PHPCS configuration
Using jQuery in new or modified JS code

When relevant, consult repository specs under .claude/specs/, especially:

.claude/specs/phpcs/nonce-verification-recommended.md
.claude/specs/phpcs/validated-sanitized-input.md
.claude/specs/phpcs/escaped-output.md

Git Operations

Follow the policy defined in AGENTS.md §5.1. Outside the issue workflow, do not run git commit or git push.

Files

Just SKILL.md in .claude/skills/wordpress-compliance of wp-media/wp-rocket.

Open the folder on GitHubat commit 3a96b66

Compare with similar skills

Wordpress Compliance next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Wordpress Compliance compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Wordpress Compliance this skillwp-media/wp-rocket	767	—	~809	Automated safety check: Pass	GPL-2.0	yesterday
WooCommerce Code Reviewwoocommerce/woocommerce	11k	3 repos	~1.1k	Automated safety check: Pass	Custom licence	yesterday
Wp Block Developmentgambitph/Stackable	350	4 repos	~1.6k	Automated safety check: Pass	GPL-3.0	2 days ago
Wp Interactivity APIAutomattic/agent-skills	211	3 repos	~1.5k	Automated safety check: Pass	None	8 mo ago
Wp Performance Reviewelvismdev/claude-wordpress-skills	235	1 repos	~4.5k	Automated safety check: Pass	MIT	10 mo ago
WooCommerce Email Editor Developmentwoocommerce/woocommerce	11k	—	~893	Automated safety check: Pass	Custom licence	yesterday

Similar skills

WooCommerce Code Review
woocommerce/woocommerce
Reviews WooCommerce code changes against the project's standards, flagging backend PHP architecture, naming, documentation, data integrity and testing violations.
11k GitHub starsUsed in 3 repos~1.1k tokens
DevelopmentAuto-check passed
Wp Block Development
gambitph/Stackable
A skill your agent uses when developing WordPress (Gutenberg) blocks: block.json metadata, registerblocktype(frommetadata), attributes/serialization, supports, dynamic rendering…
350 GitHub starsUsed in 4 repos~1.6k tokens
Auto-check passed
Wp Interactivity API
Automattic/agent-skills
A skill your agent uses when building or debugging WordPress Interactivity API features (data-wp- directives, @wordpress/interactivity store/state/actions, block viewScriptModule integration…
211 GitHub starsUsed in 3 repos~1.5k tokens
DevelopmentAuto-check passed
Wp Performance Review
elvismdev/claude-wordpress-skills
WordPress performance code review and optimization analysis.
235 GitHub starsUsed in 1 repo~4.5k tokens
Business, Finance & HRAuto-check passed
WooCommerce Email Editor Development
woocommerce/woocommerce
Sets up a local environment for the WooCommerce block email editor, with a watcher, Mailpit email capture and build and test commands for its PHP and JS packages.
11k GitHub stars~893 tokensUpdated yesterday
Backend & APIsAuto-check passed
WooCommerce Dev Cycle
woocommerce/woocommerce
Workflow for WooCommerce development: run PHP and JavaScript tests, lint and fix code style on the current branch, and follow guides for i18n and markdown.
11k GitHub starsUsed in 3 repos~431 tokens
DevelopmentAuto-check passed

More from wp-media/wp-rocket

All 15 skills in this repo

Knowledge Graph
wp-media/wp-rocket
Read and refresh wp-rocket's pre-built dependency graph at .claude/graph/dependency-graph.json.
767 GitHub stars~1.3k tokensUpdated yesterday
Auto-check passed
Issue Workflow
wp-media/wp-rocket
Work on a GitHub issue by number for wp-media/wp-rocket. An agent skill from wp-media/wp-rocket.
767 GitHub starsUsed in 1 repo~756 tokens
Auto-check passed
Wp Rocket Architecture
wp-media/wp-rocket
A skill your agent uses when changing service structure, Subscribers, ServiceProviders, Container wiring, bootstrapping, Context classes, or any code that may affect the core caching engine in WP…
767 GitHub stars~1.8k tokensUpdated yesterday
Auto-check passed
Challenge
wp-media/wp-rocket
Adversarially review a grooming spec before implementation starts.
767 GitHub stars~674 tokensUpdated yesterday
Auto-check passed
Compliance
wp-media/wp-rocket
Check a change against WordPress.org plugin rules and PHPCS standards.
767 GitHub stars~551 tokensUpdated yesterday
Auto-check passed
Docs
wp-media/wp-rocket
Update developer-facing documentation to reflect code changes on the current branch.
767 GitHub stars~1.1k tokensUpdated yesterday
Auto-check passed

Works with

Questions about Wordpress Compliance

What does Wordpress Compliance do?

A skill your agent uses when modifying templates, admin UI, output, hooks, plugin metadata, sanitization, escaping, or any code that must remain compliant with WordPress.org and repository PHPCS…. Wordpress Compliance is an agent skill from wp-media/wp-rocket.org and repository PHPCS rules.

When should I use Wordpress Compliance?

Wordpress Compliance fits situations like: modifying templates; plugin metadata; any code that must remain compliant with WordPress.org and repository PHPCS rules.

How do I install Wordpress Compliance in Claude Code?

Run `npx skills add wp-media/wp-rocket --skill wordpress-compliance -a claude-code`. Or copy the skill folder (.claude/skills/wordpress-compliance in wp-media/wp-rocket) into .claude/skills/wordpress-compliance in your project. Claude Code loads it when a task matches its description.

How do I install Wordpress Compliance in Codex?

Run `npx skills add wp-media/wp-rocket --skill wordpress-compliance -a codex`. Or copy the skill folder (.claude/skills/wordpress-compliance in wp-media/wp-rocket) into .agents/skills/wordpress-compliance in your project. Codex loads it when a task matches its description.

Can I use Wordpress Compliance in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add wp-media/wp-rocket --skill wordpress-compliance -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/wordpress-compliance, .gemini/skills/wordpress-compliance, .github/skills/wordpress-compliance and .opencode/skills/wordpress-compliance in your project.

What does Wordpress Compliance need to run?

Going by SKILL.md and its folder, Wordpress Compliance needs the command-line tools its instructions call (git).

Does Wordpress Compliance access the network?

SKILL.md contains no URLs. Its commands use git, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Wordpress Compliance safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Wordpress Compliance use?

Wordpress Compliance is published under the GPL-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Wordpress Compliance use?

About 809 tokens (SKILL.md is roughly 3.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Wordpress Compliance?

Skills that share tags, products or a category with Wordpress Compliance: WooCommerce Code Review (woocommerce/woocommerce, 11k stars), Wp Block Development (gambitph/Stackable, 350 stars), Wp Interactivity API (Automattic/agent-skills, 211 stars) and Wp Performance Review (elvismdev/claude-wordpress-skills, 235 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Wordpress Compliance?

wp-media (a GitHub organization) maintains it in wp-media/wp-rocket, which has 767 GitHub stars. The repository holds 15 skills in this directory. The repository was last updated on October 7, 2026.

Source: wp-media/wp-rocket on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Wordpress Compliance

Facts

At a glance

What it does

When your agent uses it

Example prompts

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

WordPress Compliance

Responsibilities

Escaping heuristics

Text domain

Custom capabilities

JavaScript

Anti-patterns

Related Specs

Git Operations

Files

Compare with similar skills

Similar skills

More from wp-media/wp-rocket

Related

Questions about Wordpress Compliance