How do I install the Compliance skill?

Run npx skillmds@latest add wp-media/compliance in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Compliance skill do?

Check a change against WordPress.org plugin rules and PHPCS standards. It is listed under Coding & Dev Tools on SkillMD.

Is Compliance safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Compliance?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Compliance free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Compliance?

wp-media (@wp-media) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Compliance by wp-media — Agent Skill

Name: Compliance
Author: wp-media

File contents

WordPress Compliance

Ensure compatibility with:

WordPress Plugin Check
Repository PHPCS rules
WordPress.org expectations

Config loading

Read .claude/maestro.json to load project-specific values:

TEXT_DOMAIN = .ai.text_domain (e.g. rocket, backwpup, imagify)
CAPABILITIES = .ai.capabilities (project-registered custom capabilities array)

Responsibilities

Respect repository PHPCS configuration.
Follow WordPress escaping standards.
Avoid forbidden or deprecated APIs.
Avoid direct access to superglobals without sanitization.
Ensure output is escaped for context.

Escaping heuristics

HTML text: esc_html() HTML attribute: esc_attr() URL: esc_url() Allowed HTML: wp_kses_post()

Text domain

Use {TEXT_DOMAIN} from config for all translation calls:

esc_html__( 'Clear Cache', '{TEXT_DOMAIN}' )
esc_attr__( 'Plugin Settings', '{TEXT_DOMAIN}' )

Custom capabilities

If .ai.capabilities in .claude/maestro.json is non-empty, always use those capabilities (not manage_options) for capability checks. The PHPCS config should allow them without warnings.

Example — read the list from config and use accordingly:

// Correct — use the project-registered capability, not manage_options directly
current_user_can( 'plugin_manage_options' )

Using manage_options directly for plugin-specific actions is incorrect and will flag in code review unless the project's PHPCS config explicitly allows it.

JavaScript

Do not use jQuery. Use native DOM APIs (document.querySelector, addEventListener, fetch, etc.).
jQuery is available in WordPress but its use introduces an unnecessary dependency and conflicts with modern bundling practices.

Anti-patterns

Echoing raw variables
Introducing unescaped output
Storing sensitive values in plain text
Bypassing repository PHPCS configuration
Using jQuery in new or modified JS code

Related Specs

When relevant, consult repository specs under .claude/specs/, especially:

.claude/specs/phpcs/nonce-verification-recommended.md
.claude/specs/phpcs/validated-sanitized-input.md
.claude/specs/phpcs/escaped-output.md

Git Operations

Follow the policy defined in AGENTS.md §5.1. Outside the issue workflow, do not run git commit or git push.

---name: compliancedescription: Check a change against WordPress.org plugin rules and PHPCS standards.---# WordPress ComplianceEnsure compatibility with:- WordPress Plugin Check- Repository PHPCS rules- WordPress.org expectations## Config loadingRead `.claude/maestro.json` to load project-specific values:- `TEXT_DOMAIN` = `.ai.text_domain` (e.g. `rocket`, `backwpup`, `imagify`)- `CAPABILITIES` = `.ai.capabilities` (project-registered custom capabilities array)## Responsibilities- Respect repository PHPCS configuration.- Follow WordPress escaping standards.- Avoid forbidden or deprecated APIs.- Avoid direct access to superglobals without sanitization.- Ensure output is escaped for context.## Escaping heuristicsHTML text: `esc_html()`HTML attribute: `esc_attr()`URL: `esc_url()`Allowed HTML: `wp_kses_post()`## Text domainUse `{TEXT_DOMAIN}` from config for all translation calls:```phpesc_html__( 'Clear Cache', '{TEXT_DOMAIN}' )esc_attr__( 'Plugin Settings', '{TEXT_DOMAIN}' )```## Custom capabilitiesIf `.ai.capabilities` in `.claude/maestro.json` is non-empty, always use those capabilities(not `manage_options`) for capability checks. The PHPCS config should allow themwithout warnings.Example — read the list from config and use accordingly:```php// Correct — use the project-registered capability, not manage_options directlycurrent_user_can( 'plugin_manage_options' )```Using `manage_options` directly for plugin-specific actions is incorrect and will flagin code review unless the project's PHPCS config explicitly allows it.## JavaScript- Do not use jQuery. Use native DOM APIs (`document.querySelector`, `addEventListener`, `fetch`, etc.).- jQuery is available in WordPress but its use introduces an unnecessary dependency and conflicts with modern bundling practices.## Anti-patterns- Echoing raw variables- Introducing unescaped output- Storing sensitive values in plain text- Bypassing repository PHPCS configuration- Using jQuery in new or modified JS code## Related SpecsWhen relevant, consult repository specs under `.claude/specs/`, especially:- `.claude/specs/phpcs/nonce-verification-recommended.md`- `.claude/specs/phpcs/validated-sanitized-input.md`- `.claude/specs/phpcs/escaped-output.md`## Git OperationsFollow the policy defined in AGENTS.md §5.1. Outside the issue workflow, do not run `git commit` or `git push`.

Frequently asked questions

Compliance