Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add yojahny55/claude-wp-builder/plugin install claude-wp-builderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/yojahny55/claude-wp-builder/wp-demo-verify)<a href="https://agentmods.dev/commands/yojahny55/claude-wp-builder/wp-demo-verify"><img src="https://agentmods.dev/badge/commands/yojahny55/claude-wp-builder/wp-demo-verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/yojahny55/claude-wp-builder/wp-demo-verify"><img src="https://agentmods.dev/badge/commands/yojahny55/claude-wp-builder/wp-demo-verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.01732 |
| Opus 5 | $0.00018 | $0.00866 |
| Sonnet 5 | $0.00007 | $0.00346 |
| Haiku 4.5 | $0.00004 | $0.00173 |
Grade A, and why
wp-demo-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
WP Demo Verify
A scroll page has no single state. Every scroll position is a different frame, and the failures live between the two you happened to look at. This walks the page mechanically, then hands you a contact sheet, because the half that matters is the half a machine cannot grade.
Step 1: Resolve the target
$ARGUMENTS is a file path or a URL. Default to demo/index.html. A URL lets this
run against the converted WordPress page, which is the only way to prove the motion
survived conversion. Serve files over HTTP when the page fetches anything; a
file:// page silently falls back and proves nothing.
A directory (demo/) walks every *.html in it, one output folder per page
under demo/.verify/<page>/, and findings.json carries a pages[] array. Craft
builds always pass the directory: interior pages are where a build is emptiest.
node "${CLAUDE_PLUGIN_ROOT}/bin/demo-verify.mjs" --probe answers only "can this
machine render?": exit 0 with the Chrome path, exit 2 with what is missing. /wp-demo
runs it as the craft gate before writing any markup.
Step 2a: Detector
npx -y impeccable@4 detect <target> --json > <dir>/.verify/impeccable.json
impeccable is an external package this repo does not install, vendor or
configure — it is fetched from the npm registry at run time via npx. Pin the
major version (@4; @1 does not exist on the registry) so a future major
release cannot silently change rule identifiers or output shape underneath
this gate.
The exit code says whether the scan ran, not how many findings it made: 0
is a clean or advisory-only scan, 1 means a requested target could not be
scanned at all, 2 means the scan completed and found at least one
non-advisory finding — findings do not fail the process the way a linter's
would, so a nonzero exit does not by itself mean "could not run." Only exit
1 is that case; treat it, any other exit code, a missing npx/no network
reaching the registry, or stdout that fails to parse as JSON the same way:
report "detector could not run" and fail the round on that basis, never
read as zero findings. Human-readable text goes to stderr, so the redirect
above captures only the JSON on stdout, which is what findings are counted
from — never the exit code.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +68 lines · +11 tokens per session edbf4dc06e1e
- 5d ago First seen · 65 lines · 25 tokens per session scan A 96de29b665f5
wp-demo-verify is a command published in the GitHub repository yojahny55/claude-wp-builder (6 stars, last pushed today), licensed MIT. It adds 36 tokens to every session and 1,732 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other commands, from other repositories
accessibility-specialist
Use when a screen might fail WCAG. Unlabeled inputs, no keyboard path, contrast below AA, missing landmarks, broken heading order, screen reader gaps, or a request for an a11y review or EU Accessibility Act check.
color-specialist
Use when colour is failing. Contrast below AA, a palette with no system behind it, dark mode that is only inverted light mode, or semantic colours that carry no meaning.
conversational-ui-designer
Use when designing a chat or assistant interface. Message layout, bot personality, streaming and typing states, rich message cards, error recovery, or voice input.
form-designer
Use when a form is losing people. Too many fields, validation that interrupts typing, unclear required fields, a multi-step flow with no sense of progress, or inputs with no labels.
healthcare-ux-specialist
Use when designing clinical or patient-facing interfaces. Clinical workflows, displaying sensitive patient data, HIPAA considerations in the UI, and medical terminology patients do not speak.
motion-designer
Use when animation feels wrong. Transitions too slow or too bouncy, motion with no purpose, blanket transitions on every property, no reduced-motion support, or animation that drops frames.