v1.0.0

First tagged release of WordPress Security Skills: security guidance that AI coding agents (Claude Code, Cursor, Codex, OpenCode, Gemini CLI) load when they write or review WordPress plugins and themes.

Highlights

• 27 skills, one per security topic: input and output handling, SQL, nonces and capabilities, REST and AJAX, uploads and filesystem, SSRF, secrets, privacy, multisite, WooCommerce, headers and CSP, supply chain, authentication, and more.
• New ai-llm-integration-security skill for AI features: untrusted model output, prompt injection from site content, capability-checked tools and Abilities API abilities, confirmation for destructive actions, and server-side provider keys with spend limits.
• Stronger audit workflow in security-auditing-code-review: guidance vs full-review modes, three verdicts (confirmed, needs_validation, rejected), WordPress severity anchors, WordPress attack classes beyond the sink sweep, a coverage ledger, a disprove-first validation workflow, and a resource-exhaustion reference.
• Eval scenarios for every skill, with the first recorded evaluation run.
• Validation tooling and CI: metadata, scenario, and Markdown validators, the official skills-ref validator, install smoke test, link checks, PHPCS, and secret scanning.
• Rewritten README with a quick start, a skill catalog grouped by topic, and per-agent installation steps.

Install

npx skills add wpultimatesecurity/WordPress-Security-Skills

See the README for other installation options, and CHANGELOG.md for the full list of changes.

Acknowledgments

Parts of the audit workflow adapt ideas from Cloudflare's MIT-licensed security-audit skill, rewritten for WordPress.