Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/yojahny55/claude-wp-builder/wp-cli-patternsnpx skills add yojahny55/claude-wp-builder --skill wp-cli-patternsgit clone --depth 1 https://github.com/yojahny55/claude-wp-builderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yojahny55/claude-wp-builder/wp-cli-patterns)<a href="https://agentmods.dev/skills/yojahny55/claude-wp-builder/wp-cli-patterns"><img src="https://agentmods.dev/badge/skills/yojahny55/claude-wp-builder/wp-cli-patterns.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00037 | $0.02771 |
| Opus 5 | $0.00018 | $0.01385 |
| Sonnet 5 | $0.00007 | $0.00554 |
| Haiku 4.5 | $0.00004 | $0.00277 |
Grade A, and why
wp-cli-patterns scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 301 lines — stays where its author put it; the contents beside it link to each section on GitHub.
WP-CLI Patterns — Best Practices for All Agents
This skill teaches the WP-CLI-first principle: use WP-CLI commands instead of generating PHP code whenever possible. WP-CLI saves tokens, reduces errors, and executes faster than writing throwaway PHP files.
Core Rule: WP-CLI Over PHP Generation
Always prefer a single WP-CLI command over generating PHP code.
# BAD (costs tokens): Generate PHP file with update_option()
# GOOD (1 line): $WP option update my_option 'value'
# BAD: Generate PHP with wp_insert_post()
# GOOD: $WP post create --post_type=page --post_title='About' --post_status=publish
# BAD: Generate PHP with wp_create_nav_menu()
# GOOD: $WP menu create "Primary EN" && $WP menu item add-post primary-en 5
# BAD: Generate PHP to activate a plugin
# GOOD: $WP plugin activate secure-custom-fields
# BAD: Generate PHP to set permalink structure
# GOOD: $WP rewrite structure '/%postname%/'
Use wp eval only when no dedicated WP-CLI subcommand exists for the operation (e.g., calling ACF's update_field() API).
The $WP Convention
Throughout all commands, agents, and skills, $WP is shorthand for the value of wp_cli.wrapper from .wp-create.json. Agents read this value and substitute it into all WP-CLI commands.
For example, if the environment is Docker:
# $WP expands to:
docker exec my-project-wp wp --allow-root
# So this command:
$WP option update blogname "My Site"
# Becomes:
docker exec my-project-wp wp --allow-root option update blogname "My Site"
How to read $WP: Parse .wp-create.json at the project root and extract the wp_cli.wrapper value. Every WP-CLI command in this skill assumes $WP is set to that value.
Environment-Aware Execution
Agents read wp_cli.wrapper from .wp-create.json and prepend it to all WP-CLI commands. The wrapper value depends on the environment type:
| Environment | wp_cli.wrapper value |
Notes |
|---|---|---|
| Native | wp --path=/var/www/html/my-project |
Direct CLI, requires WP-CLI installed on host |
| Docker | docker exec my-project-wp wp --allow-root |
Executes inside WordPress container |
| DDEV | ddev wp |
DDEV proxies to the web container |
| Lando | lando wp |
Lando proxies to the appserver container |
| wp-env | npx wp-env run cli wp |
wp-env proxies to its CLI container |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +26 lines 26de39843d24
- 4d ago First seen · 275 lines · 37 tokens per session scan A 438a9c205a81
wp-cli-patterns is a skill published in the GitHub repository yojahny55/claude-wp-builder (6 stars, last pushed today), licensed MIT. It adds 37 tokens to every session and 2,771 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
Website Audit
Comprehensive website auditing skill using Lighthouse, PageSpeed Insights, and web performance APIs to audit performance, accessibility, SEO, best practices, and security.
goshipit
Pre-launch codebase audit skill. Use this whenever someone is about to ship, deploy, launch, push to main/prod, or merge a release - even without "goshipit" explicitly. Trigger on: "is my app ready?", "can I deploy now?", "pre-deploy check", "review before launch", "is this production-ready?", "check my codebase"…
foreman
Run a website build as the brain agent. Interview the user, force the scope and design decisions they would otherwise skip, lock a visual system, write one high-quality build brief, then either build it in this session or hand it to a coding agent (Codex, Claude Code, or any harness), and verify and ship it live. Use…
tsq-product-audit
통합 제품 감사 스킬. 7개 영역(Security, Performance, SEO, Accessibility, UI/UX, Architecture, Functional)을 정량 스코어링으로 평가하고, 6단계 사이클(Plan→Audit→Report→Remediation Plan→Fix→Re-audit)로 운영한다. Use when: Phase gate 전 품질 확인, 보안 감사, 성능 리뷰, 접근성 점검, 릴리스 전 최종 검증, 코드 감사 요청 시.
river-review-frontend
フロントエンド観点のレビューエージェント。 アクセシビリティ、デザインシステム準拠、Tailwind クラス衛生、UI 状態設計、 Next.js / React Router のフレームワーク境界を個別スキルへルーティングする。.
claude-bionify
Configure and control the claude-bionify bionic reading plugin. Use when the user asks about bionic reading settings (fixation/strength, boundary, minimum word length, acronyms, URLs, headings), wants to turn the bionic display on, off, or toggle it, asks for the current status, or asks how to use the /claude-bionify…