Wp Plugin Skill — Security skill for Claude Code

---

The problem

Ask any AI to "add an AJAX handler that saves settings" and you will usually get this:

add_action( 'wp_ajax_save_settings', 'save_settings' );
add_action( 'wp_ajax_nopriv_save_settings', 'save_settings' );

function save_settings() {
    update_option( $_POST['name'], $_POST['value'] );
    echo $_POST['message'];
    wp_die();
}

It works. It also hands **any visitor on the internet** full control of the site — set `default_role` to `administrator`, enable registration, sign up, done. Plus reflected XSS and an unprefixed function name that will collide with the next plugin.

Every one of those is a real, catalogued vulnerability class that appears in WordPress plugin CVEs every week.

What changes

With the skill loaded, the same request produces:

add_action( 'wp_ajax_myplugin_save_settings', 'myplugin_save_settings' );
// No nopriv variant — this is not a public action.

function myplugin_save_settings() {
    if ( ! current_user_can( 'manage_options' ) ) {              // Gate 2: authorization
        wp_send_json_error( array( 'message' => __( 'Forbidden', 'my-plugin' ) ), 403 );
    }
    che