Use this agent when you need expert guidance on WooCommerce Core development, including writing or reviewing code that extends, integrates with, or modifies WooCommerce; implementing custom payment gateways, shipping methods, or product types; working with WooCommerce hooks, filters, and APIs; debugging…
Review code changes for quality, WordPress coding standards, and ATmosphere conventions. Use when asked to review a PR, branch, diff, or specific files.
Defensive first-party security review of the plugin's own code to detect and help fix weaknesses (SSRF, OAuth bypass, XSS, token leakage, DPoP issues) before release. Use when asked to check security, harden the plugin, or review the code for vulnerabilities to fix.
Check AT Protocol and standard.site spec compliance. Use when asked to verify Lexicon conformance, OAuth flow correctness, or record schema validation.
Audits a generated or existing WordPress block theme for FSE correctness, theme.json validity, accessibility, i18n, and the plugin's non-negotiable quality rules. Use proactively after generating a theme with /convert-to-wp-theme or /scaffold-wp-theme, or when the user asks to review, audit, or QA a block theme.
Sub-agents the main Claude Code agent can delegate to. Each one runs in its own context window, with its own restricted tool set, so the main agent stays focused.
Audits a feature plan PR before human review — checks spec.md and plan.md against the planning conventions in PLANNING.md and the constitution's allowlists. Reports findings; never modifies files. Invoke during Phase 2.5 (plan freeze) of the wordpress-feature skill, after scripts/open-plan-pr.sh opens the plan PR and…
Audits WordPress PHP and JavaScript for security issues against the project's SECURITY.md checklist. Reports findings; never modifies code. Invoke before merging any PR or shipping a release.
Deep-analyzes WordPress plugins — architecture, class maps, execution flows, hook chains, data lifecycle, and extensibility patterns. Produces multi-file documentation in agent memory. Invoke when the user wants to understand, document, or explore a WordPress plugin from a local path or a GitHub URL (public or…