Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nathanonn/agent-skills --skill wp-rest-apigit clone --depth 1 https://github.com/nathanonn/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nathanonn/agent-skills/wp-rest-api)<a href="https://agentmods.dev/skills/nathanonn/agent-skills/wp-rest-api"><img src="https://agentmods.dev/badge/skills/nathanonn/agent-skills/wp-rest-api/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nathanonn/agent-skills/wp-rest-api"><img src="https://agentmods.dev/badge/skills/nathanonn/agent-skills/wp-rest-api.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00200 | $0.04163 |
| Opus 5.5 | $0.00080 | $0.01665 |
| Sonnet 5.5 | $0.00040 | $0.00833 |
| Haiku 4.5 | $0.00020 | $0.00416 |
Grade A, and why
wp-rest-api scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
description: "Push generated block markup, CSS and JS animation into a WordPress site over the core REST API, authenticated with an admin Application Password — no MCP server, no CLI, no SSH, curl only. Use when the user How it starts
The opening of the file, as written. The whole thing — 239 lines — stays where its author put it; the contents beside it link to each section on GitHub.
wp-rest-api
Transmit assets that already exist — block markup, CSS, and animation JS — to a WordPress site
over /wp-json/, using curl and an admin Application Password. This is the last mile that used
to be a copy-paste into the Code Editor. The markup is generated elsewhere; this skill transmits
bytes unchanged and tells you the truth about what the site did with them.
Everything needs curl and jq (1.6+), plus grep and diff for the verification steps. Nothing
else — no MCP server, no CLI, no SSH, no database access.
| Reference | Read it when |
|---|---|
reference/endpoints.md |
before any request — exact paths, payload shapes, copy-pasteable curl |
reference/safety-rules.md |
once per session, before the first write. The rules that are not negotiable |
reference/gutenberg-traps.md |
before pushing markup, and whenever the editor looks wrong while the frontend looks right |
reference/code-snippets.md |
only when shipping PHP or JS — the snippet route, end to end |
reference/animation.md |
only when the page carries GSAP or any other JS animation |
reference/troubleshooting.md |
a 500, a non-JSON body, a socket error, or a plugin that will not activate |
reference/integrations.md |
the user mentions a markup validator or a credential-masking plugin, or you are running one |
1 · Preflight — three reads before any write
Run all three. Do not skip one because the last session passed.
| # | Request | What you are asking | Stop if |
|---|---|---|---|
| 1 | GET /wp-json/ (no auth) |
does the site answer, is wp/v2 in namespaces[] |
non-JSON body, or wp/v2 absent — pretty permalinks may be off, or a plugin is blocking REST |
| 2 | GET /wp/v2/users/me?context=edit (auth) |
do the credentials work, is this user an administrator | 401 rest_not_logged_in, or capabilities.edit_theme_options is not true |
| 3 | GET /wp/v2/themes?status=active (auth) |
is the active theme a block theme, and what is the global-styles record id | is_block_theme is false — the CSS route in §4 does not exist. Say so and stop, or offer the §5 alternative |
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 239 lines · 200 tokens per session scan A 13ce3e0f2608
wp-rest-api is a skill published in the GitHub repository nathanonn/agent-skills (21 stars, last pushed 1mo ago), licensed MIT. It adds 200 tokens to every session and 4,163 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-17.
Other skills, from other repositories
engram-dashboard-htmx
HTMX and templ interaction rules for the Engram dashboard. Trigger: Any change to htmx attributes, partial updates, forms, or server-rendered browser UI.
add-permission
Add a permission constant across backend and frontend.
nextjs-typescript-tailwindcss-supabase
Full-stack Next.js 14 development with TypeScript, TailwindCSS, and Supabase for building production-ready web applications.
orchardcore-crestapps-resources
Skill for CrestApps resource-management extensions in Orchard Core. Covers the shared registered scripts and stylesheets, local asset and CDN fallback behavior, resource names, dependency consumption, and safe Razor registration. Use this skill when requests mention CrestApps shared resources, Orchard Core resource…
vite-patterns
Use when configuring or optimizing Vite (laravel-vite-plugin) asset bundling in a Laravel app — entrypoints, the @vite Blade directive, HMR, env vars, aliases, manifests, code splitting, and production builds.
convert-to-go-project
Converts existing Express/Fastify, Django/Flask/FastAPI, Laravel/PHP, Next.js/React, and Go projects to Go + Templ + HTMX + Tailwind. Applies to whole-project migrations and existing Go projects that need this stack. Skips greenfield creation and isolated HTMX or templUI help.