Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/iwritec0de/wp-dev/wp-scaffoldgit clone --depth 1 https://github.com/iwritec0de/wp-devWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00026 | $0.01534 |
| Opus 5 | $0.00013 | $0.00767 |
| Sonnet 5 | $0.00005 | $0.00307 |
| Haiku 4.5 | $0.00003 | $0.00153 |
Grade A, and why
wp-scaffold scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 140 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/wp-scaffold
Generate WordPress component boilerplate that follows WPCS and includes proper security patterns.
Load the wordpress-engineer, wordpress-standards, and wordpress-security skills for coding conventions, security patterns, and architecture guidance.
Usage
Parse the user's arguments to determine what to scaffold:
plugin <slug>— Full plugin boilerplatetheme <slug>— Full theme boilerplateblock <slug>— Gutenberg block (block.json, edit.js, save.js, render.php)cpt <name>— Custom Post Type registrationtaxonomy <name>— Custom Taxonomy registrationrest <route>— REST API endpointwidget <name>— Widget classshortcode <name>— Shortcode handlerwoo-product-tab— WooCommerce product data tabperf-monitor— Performance monitoring mu-plugin (REST API diagnostics)
Arguments
The user provides arguments after /wp-scaffold. For example: /wp-scaffold plugin my-cool-plugin
If no arguments are given, ask the user what they want to scaffold using AskUserQuestion.
Scaffold Specifications
Plugin (plugin <slug>)
Create the following files:
<slug>/<slug>.php— Main plugin file with header comment, constants (VERSION, PATH, URL), activation/deactivation hooks, and main class instantiation<slug>/includes/class-<slug>.php— Main plugin class with init method, hook registration<slug>/uninstall.php— Cleanup file that checksWP_UNINSTALL_PLUGIN, deletes options and custom tables<slug>/readme.txt— WordPress.org readme template<slug>/languages/<slug>.pot— Empty POT file placeholder
All files must include:
- File header DocBlock with
@package,@since - Proper text domain matching the slug
- Security:
defined( 'ABSPATH' ) || exit;at the top of each PHP file - Prefixed functions/hooks using slug converted to snake_case
Theme (theme <slug>)
Create:
<slug>/style.css— Theme header with Theme Name, Version, Text Domain, etc.<slug>/functions.php— Theme setup (add_theme_support), enqueue, widget areas<slug>/index.php— Basic template with the loop<slug>/header.php— Document head, wp_head(), site header<slug>/footer.php— Site footer, wp_footer()<slug>/single.php— Single post template<slug>/page.php— Page template<slug>/404.php— Not found template<slug>/sidebar.php— Sidebar template
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 140 lines · 26 tokens per session scan A a5cd6693d1bc
wp-scaffold is a command published in the GitHub repository iwritec0de/wp-dev (1 stars, last pushed 4mo ago), licensed MIT. It adds 26 tokens to every session and 1,534 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
merge
Finalize work on a branch: verify docs + tree are clean, merge to main, clean up. Supports both standard git checkout -b branches and git worktree flows — auto-detected at pre-flight.
expect
Diff-aware AI browser testing — reads the git diff, maps changes to affected pages via the route map, generates a targeted test plan, and executes it via agent-browser (Rust daemon + CDP, ARIA-tree-first) with pass/fail reporting. Use when testing UI changes, verifying PRs before merge, or running regression checks on…
speckit.tasks
Generate an actionable, dependency-ordered tasks.md for the feature based on available design artifacts.
dev
Runs Vendure in development mode. By default it starts three processes: the GraphQL server (ts-node ./src/index.ts), the worker (ts-node ./src/index-worker.ts), and the dashboard (a Vite dev server).
start
Runs a project that has already been compiled with vendure build.
pipeline-undo
Undo a pipeline run's result. With worktree isolation (the current engine), this is clean and low-risk: a run never touches your checkout — its result lives only on a pipeline/ branch (and, for a --push run, on the remote). "Undo" therefore means deleting that branch and its worktree, not reverting your working tree.