A guide for using PHPStan, a tool that checks PHP code for likely errors, in WordPress projects. It covers WordPress plugins, themes, and sites.

Setting up phpstan.neon, updating error baselines, adding WordPress type information, and addressing third-party plugin or theme classes.

It helps configure the checker and handle WordPress functions, types, and classes that PHPStan may not understand by itself.

wp-phpstan — Skill for Claude Code by dr-robert-li

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add dr-robert-li/cowork-wordpress-expert --skill wp-phpstan

Clone the repo

git clone --depth 1 https://github.com/dr-robert-li/cowork-wordpress-expert

Made for: Claude Code.

Or install wordpress-expert, the plugin that ships this one along with the rest of its 54 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/dr-robert-li/cowork-wordpress-expert/wp-phpstan.svg)](https://agentmods.dev/skills/dr-robert-li/cowork-wordpress-expert/wp-phpstan)

Your own site

<a href="https://agentmods.dev/skills/dr-robert-li/cowork-wordpress-expert/wp-phpstan"><img src="https://agentmods.dev/badge/skills/dr-robert-li/cowork-wordpress-expert/wp-phpstan.svg" alt="Measured on agentmods" height="20"></a>

Per session 47 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 931 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00047	$0.00931
Opus 5	$0.00023	$0.00465
Sonnet 5	$0.00009	$0.00186
Haiku 4.5	$0.00005	$0.00093

Measured 7d ago against content hash 227d3025f585, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

wp-phpstan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

2 near-identical copies found in the catalogue:

wp-phpstan — 100% identical, 0 lines differ
wp-phpstan — 100% identical, 0 lines differ

references/wp-phpstan/SKILL.md · 98 lines

How it starts

The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.

WP PHPStan

When to use

Use this skill when working on PHPStan in a WordPress codebase, for example:

setting up or updating phpstan.neon / phpstan.neon.dist
generating or updating phpstan-baseline.neon
fixing PHPStan errors via WordPress-friendly PHPDoc (REST requests, hooks, query results)
handling third-party plugin/theme classes safely (stubs/autoload/targeted ignores)

Inputs required

wp-project-triage output (run first if you haven't)
Whether adding/updating Composer dev dependencies is allowed (stubs).
Whether changing the baseline is allowed for this task.

Procedure

0) Discover PHPStan entrypoints (deterministic)

Inspect PHPStan setup (config, baseline, scripts):
- node skills/wp-phpstan/scripts/phpstan_inspect.mjs

Prefer the repo’s existing composer script (e.g. composer run phpstan) when present.

1) Ensure WordPress core stubs are loaded

szepeviktor/phpstan-wordpress or php-stubs/wordpress-stubs are effectively required for most WordPress plugin/theme repos. Without it, expect a high volume of errors about unknown WordPress core functions.

Confirm the package is installed (see composer.dependencies in the inspect report).
Ensure the PHPStan config references the stubs (see references/third-party-classes.md).

2) Ensure a sane `phpstan.neon` for WordPress projects

Keep paths focused on first-party code (plugin/theme directories).
Exclude generated and vendored code (vendor/, node_modules/, build artifacts, tests unless explicitly analyzed).
Keep ignoreErrors entries narrow and documented.

See:

references/configuration.md

3) Fix errors with WordPress-specific typing (preferred)

Prefer correcting types over ignoring errors. Common WP patterns that need help:

REST endpoints: type request parameters using WP_REST_Request<...>
Hook callbacks: add accurate @param types for callback args
Database results and iterables: use array shapes or object shapes for query results
Action Scheduler: type $args array shapes for job callbacks

Read the full file on GitHub · 98 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

7d ago First seen · 98 lines · 47 tokens per session scan A 227d3025f585

Subscribe to this mod's changes

wp-phpstan is a skill published in the GitHub repository dr-robert-li/cowork-wordpress-expert (28 stars, last pushed 6mo ago), licensed MIT. It adds 47 tokens to every session and 931 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Debugging Languages PHP

sentry-php-sdk

Full Sentry SDK setup for PHP. Use when asked to "add Sentry to PHP", "install sentry/sentry", "setup Sentry in PHP", or configure error monitoring, tracing, profiling, logging, metrics, crons, or AI monitoring for PHP applications. Supports plain PHP, Laravel, and Symfony.

getsentry/sentry-for-ai · 71 tokens

bug-root-cause-finder

Root cause analysis methods for PHP bugs. Provides 5 Whys technique, fault tree analysis, git bisect guidance, and stack trace parsing.

dykyi-roman/awesome-claude-code · 36 tokens

check-cascading-failures

Detects cascading failure risks in PHP systems. Identifies shared resources, unbounded queues, missing backpressure, thread pool exhaustion, and failure propagation paths.

dykyi-roman/awesome-claude-code · 39 tokens

php-quality-tooling

Use when setting up PHPStan, Rector, or PHP-CS-Fixer on a non-Laravel PHP project, incl. CI wiring. Do NOT use for Laravel (Pint/Larastan), tests, or syntax.

fusengine/agents · 51 tokens

phpstan-fixer

Fix PHPStan static analysis errors by adding type annotations and PHPDocs. Use when encountering PHPStan errors, type mismatches, missing type hints, or static analysis failures. Never ignores errors without user approval.

marcelorodrigo/agent-skills · 46 tokens

wp-phpstan-static-analysis

Run PHPStan static analysis on a WordPress plugin or theme using szepeviktor/phpstan-wordpress. Covers the composer dev-dependencies and what is pulled transitively (phpstan/phpstan ^2.0, php-stubs/wordpress-stubs), the optional phpstan/extension-installer that auto-registers the extension, the phpstan.neon.dist…

Lonsdale201/wp-agent-skills · 227 tokens