AI WordPress Development Tools and Skills

How Skills and Tools Work

WP HoloDev separates knowledge from actions. Skills help the coding agent understand how a particular WordPress job should be approached. Tools are what let it inspect the project, change files, run commands, test the result and carry out the rest of the development work.

Skills Provide Specialist Knowledge

Skills give the agent extra guidance for areas such as plugin development, WordPress security, REST APIs, database work, testing and release preparation. The harness can load the skills that are relevant to the job rather than expecting one general prompt to contain everything the agent needs to know.

How to use it: You normally do not need to select a skill manually. Tell WP HoloDev what you want done, for example, “Review this plugin for WordPress security problems” or “Build a REST endpoint for this plugin.” The harness can then bring the appropriate skills into the job automatically.

Tools Perform Real Development Actions

Tools are the practical side of the harness. They let the agent read and edit files, run commands, inspect Git changes, start tests, use a browser, validate WordPress code, build ZIP files and perform other development work.

How to use it: Ask for the result you want rather than trying to operate every tool yourself. For example, “Fix this bug and run the tests afterwards” can involve repository inspection, file editing, command execution and validation without you having to trigger each tool separately.

The Harness Remains in Control

The AI model does not get unrestricted access to your computer just because it wants to use a tool. WP HoloDev checks the project scope, permissions and approval requirements before an action is allowed to happen.

How to use it: Work normally in the project chat. If the agent needs an action that requires approval, WP HoloDev will stop at that boundary and ask before carrying it out. You can approve it, refuse it or change the instruction.

Built-In Development Tools

WP HoloDev includes the tools needed for an AI coding agent to work on a real project rather than just hand you blocks of code and hope they work.

Repository Inspection and Code Intelligence

WP HoloDev can inspect the structure of a project and identify classes, functions, namespaces, hooks, shortcodes, REST routes, AJAX handlers, cron events, database usage, options, dependencies and relationships between files.

How to use it: Open the project you want to work on and ask something such as “Find where this shortcode is registered and show me everything involved in rendering it” or “Map the plugin before changing anything.” WP HoloDev will inspect the relevant files and follow the code relationships needed to answer the request.

Controlled File Reading

The coding agent can read files inside the authorised project workspace without automatically gaining access to unrelated files elsewhere on the computer.

How to use it: Ask the agent to inspect a particular part of the project, for example, “Read the payment classes and explain how checkout currently works.” You can also ask it to investigate first and make no changes until the existing implementation has been understood.

Controlled File Editing

WP HoloDev can edit the real project files needed for a task while keeping those changes inside the controlled workspace and making them available for later review.

How to use it: Describe the change you want, for example, “Add a setting that lets the administrator disable this feature.” The agent can find the correct files, make the required changes and continue into validation afterwards. You do not need to tell it which individual files to edit unless you want to restrict the work.

Project Command Execution

WP HoloDev can run development commands against the project instead of asking the model to guess whether the code will build or whether the tests will pass.

How to use it: Ask directly, for example, “Run the test suite,” “Build the frontend,” or “Run the project's validation commands.” Commands that cross an approval boundary are held until you approve them rather than being executed silently.

Git Baselines and Diffs

Git can be used to record the starting state of the project and show exactly what changed during the development task.

How to use it: Before a larger change, ask WP HoloDev to establish a baseline. After the work is finished, ask “Show me the final diff” or “Review every file changed in this task.” This lets you compare the finished work with the original code rather than relying on the agent's summary.

PHP Syntax Validation

WP HoloDev can run real PHP syntax checks so a malformed PHP file is caught before the job is accepted as complete.

How to use it: Ask “Run PHP syntax checks on every changed PHP file.” You can also make syntax validation part of the completion requirements so it runs automatically before the agent is allowed to finish the job.

PHPCS

PHP_CodeSniffer can inspect PHP files against configured coding standards and report the exact file and line where a problem is found.

How to use it: Ask “Run PHPCS on the changed files and fix any new violations.” WP HoloDev can run the checker, inspect the findings, correct the code and rerun PHPCS to prove the problems have been resolved.

WordPress Coding Standards

WordPress Coding Standards can be applied through PHPCS when you want the finished code checked against WordPress conventions.

How to use it: Ask “Run WordPress Coding Standards before completing this plugin.” If violations are found, the agent can fix them and rerun the check until the required standard passes.

PHPStan Static Analysis

PHPStan can find type problems, invalid assumptions and other issues without having to execute the application.

How to use it: Ask “Run PHPStan against this project and investigate any new errors.” WP HoloDev can compare the findings with the project baseline, fix problems introduced by the current task and rerun the analysis afterwards.

PHPUnit Testing

If the project includes PHPUnit tests, WP HoloDev can run them and use failures as part of the development loop instead of simply reporting that the code should work.

How to use it: Ask “Run the PHPUnit tests after making the change.” If a test fails, tell WP HoloDev to investigate the failure, correct the implementation and run the test suite again. You can also require a passing test suite before completion.

WordPress Plugin Check

Plugin Check can catch common WordPress plugin problems and issues that matter when preparing a plugin for release or WordPress.org.

How to use it: Ask “Run Plugin Check on the finished plugin and fix any problems caused by this release.” WP HoloDev can run the check against the actual plugin, inspect the findings and rerun it after corrections.

Deterministic Security Validation

WP HoloDev includes rule-based security checks for common WordPress problems such as missing nonces, unescaped output, unsafe SQL, missing capability checks, unsafe REST or AJAX permissions, open redirects and file traversal risks.

How to use it: Ask “Run the WordPress security checks against every file changed in this task.” You can also require security validation as part of the completion gate so the job cannot be marked complete while required security checks are failing.

Regression Baseline Comparison

A project may already contain warnings before the agent touches it. WP HoloDev can record those first and compare them with the results after the work is finished.

How to use it: Ask “Create a validation baseline before changing anything.” After the work, ask WP HoloDev to compare the new results with that baseline. It can then distinguish existing issues from problems introduced by the current task.

Disposable WordPress Test Environments

Plugins and themes can be tested in clean WordPress environments instead of relying only on the state of an existing development site.

How to use it: Ask something such as “Test this plugin on a clean WordPress installation” or “Check this against the supported PHP and WordPress versions.” WP HoloDev can prepare the isolated test environment, install the project, run the required checks and dispose of the environment when the test is finished.

WP-CLI

WP-CLI lets the harness carry out WordPress operations from the command line inside an authorised development environment.

How to use it: Ask for the WordPress action you need, for example, “Activate the plugin in the test site,” “Create a test administrator,” or “Show me the active plugins.” WP HoloDev can translate the task into the appropriate WP-CLI commands and execute them through the harness.

Playwright Browser Testing

Playwright lets WP HoloDev interact with the real website in a browser so frontend and administration behaviour can be tested rather than inferred from the code.

How to use it: Describe what a user should be able to do, for example, “Log in as an administrator, open the plugin settings, enable the option, save it and confirm the setting remains enabled after refresh.” WP HoloDev can carry out those steps in the browser and report what actually happened.

WordPress Workflow Testing

Complete WordPress workflows can be tested across several steps, including installation, activation, login, administration pages, forms, AJAX requests, REST endpoints and role-based access.

How to use it: Give WP HoloDev the whole workflow you want proved. For example, “Install the plugin on a clean site, activate it, create an editor account, log in as that editor and confirm the settings page is not accessible.” The harness can perform the workflow from start to finish and use the result as validation evidence.

Browser Screenshots

Browser screenshots provide visual evidence of how a page or interface looks after a change has been made.

How to use it: Ask “Open the settings page after the change and capture a screenshot.” You can combine screenshots with a browser test so WP HoloDev first performs the required actions and then captures the final state.

WordPress Model Benchmarks

WP HoloDev can benchmark configured AI models against realistic WordPress development tasks instead of choosing a coding model only by reputation or general-purpose scores.

How to use it: Open the model benchmarking workflow and run the WordPress benchmark against the models you want to compare. Review the results before deciding which model should be used for efficient, balanced or more demanding development work.

Safe ZIP and Archive Handling

ZIP files and other archives can be checked for suspicious or dangerous contents before they are extracted into the development environment.

How to use it: Import the archive through the normal project workflow instead of extracting unknown files manually. WP HoloDev can inspect the archive first and reject dangerous paths, unsafe links, abnormal compression behaviour and other archive problems before extraction is allowed.

Release Packaging

Once development and validation are complete, WP HoloDev can build a clean distributable ZIP from the project.

How to use it: Ask “Prepare this plugin for release.” WP HoloDev can run the required final checks, collect the correct release files and build the ZIP from the validated project instead of asking you to package it manually.

Release Manifests

A release manifest records information about the package that has been produced so the release is not just an unexplained ZIP file.

How to use it: Generate the release through WP HoloDev's release workflow. The manifest is produced alongside the release information and can be reviewed with the package before you distribute or deploy it.

SHA-256 Integrity Checking

WP HoloDev can generate a SHA-256 checksum that identifies the exact release package that was produced.

How to use it: Build the release through WP HoloDev and keep the generated SHA-256 value with the release record. You can later calculate the checksum of the ZIP again and compare the two values to confirm that you still have the exact same package.

Validation Reports

Validation results can be kept as evidence of the checks that actually ran against the project rather than disappearing when the conversation ends.

How to use it: Run the required validators before release, then open the validation results and review what passed, what failed and what was skipped. Do not package the release until the checks you require are passing.

Final-Test Release Locking

WP HoloDev can lock the release source before the final validation run so the package is built from the same code that actually passed the final checks.

How to use it: Start the final release workflow after development is complete. WP HoloDev locks the release state, reruns the required checks and then builds the package from that validated state. If the source changes afterwards, run the final release process again rather than treating the old validation as proof for the new code.

WordPress Bridge Deployment

The WP HoloDev bridge lets a validated plugin release be sent to a WordPress site without giving the coding agent FTP credentials, hosting passwords or unrestricted access to the server.

How to use it: First pair the WordPress site with the project. In WP HoloDev, start the site's pairing setup and obtain the bridge plugin and one-time pairing information. Install and activate the bridge plugin on the WordPress site you want to connect. Complete the pairing so that site is registered against the correct WP HoloDev project. Once the site is paired and the release has passed its required checks, run /deploy in the project chat. WP HoloDev builds or selects the validated release, sends it through the paired bridge, performs the authorised WordPress update and then runs post-deployment checks to confirm the expected release is installed and the site is still responding.

Backup and Rollback

The deployment workflow can preserve the previous plugin state so a bad deployment does not automatically become permanent.

How to use it: Deploy through the WP HoloDev bridge rather than replacing the plugin manually. If the new release needs to be reversed, open the deployment controls for the paired site and choose the rollback action for that deployment. WP HoloDev restores the previous version and can then run the site checks again to confirm the rollback succeeded.

Structured Audit Logging

WP HoloDev records development activity such as tool calls, validation, sandbox operations, cancellations and security events so you can see what actually happened during a job.

How to use it: Open the execution trace for the development task. Use it when you want to see which agent performed an action, which tool was used, what command ran, whether approval was required and what result came back.

Secret Detection and Redaction

WP HoloDev is designed to keep provider credentials and other sensitive information out of project files, prompts and stored execution data wherever possible.

How to use it: Add provider credentials through WP HoloDev's connection or credential setup rather than pasting API keys into a project chat or source file. If sensitive material appears where it should not, the harness can detect and redact it from supported stored output.

Sandboxed Execution

Commands can run inside restricted execution environments with limits around files, resources and network access instead of automatically receiving full access to the host computer.

How to use it: Ask WP HoloDev to run the command or development task normally. The harness chooses the appropriate execution environment and applies its restrictions. If an operation needs access beyond the current permissions, it must pass the relevant approval boundary before proceeding.

60 Built-In WordPress Skills

WP HoloDev comes with 60 built-in WordPress skills covering the main areas of WordPress development. These are not separate applications you need to learn. They are extra instructions the harness can give the agent when a job needs particular WordPress knowledge.

More than one skill can be used during the same job. A plugin feature involving a REST endpoint, database work and permissions can use the relevant skills together while the harness continues to control what the agent is actually allowed to do.

WordPress Core Architecture

Helps the agent understand how WordPress loads, how hooks and APIs fit together and how the main parts of WordPress interact.

How to use it: Ask something such as “Trace how this request moves through WordPress before changing the code” or “Explain which hooks this feature depends on.” The harness can give the agent the core architecture skill while it investigates the project.

Plugin Development

Covers the patterns used when building, extending and maintaining WordPress plugins.

How to use it: Ask WP HoloDev to build or modify the plugin normally. For example, “Add an admin setting to this plugin and keep the implementation consistent with the existing architecture.” The plugin development skill can be applied as part of the job.

Theme Development

Covers WordPress themes, templates, hooks, stylesheets, scripts and theme-specific behaviour.

How to use it: Ask for the theme change you want, for example, “Add this layout to the child theme without modifying the parent theme.” WP HoloDev can combine theme knowledge with file inspection and browser testing.

WordPress Coding Standards

Helps the agent write and review code using the conventions expected in WordPress projects.

How to use it: Tell WP HoloDev “Follow WordPress Coding Standards for this entire change and run WPCS afterwards.” The skill guides the implementation and the real validator checks the finished code.

WordPress Security

Covers capabilities, nonces, sanitisation, escaping, database access, permissions and other common WordPress security requirements.

How to use it: Ask “Review this feature for WordPress security problems before making any changes,” or make security part of the job requirements. The security skill can guide the review while deterministic security tools check the actual code.

REST API

Covers WordPress REST routes, callbacks, permissions, authentication, request data and responses.

How to use it: Ask “Create a REST endpoint that returns this data and only allows administrators to use it.” WP HoloDev can apply the REST skill, implement the endpoint and then test the route and its permission behaviour.

AJAX

Covers WordPress AJAX handlers, including nonces, permissions, input handling and responses.

How to use it: Ask “Add an AJAX action for this form and make sure unauthorised users cannot call it.” The skill guides the WordPress implementation while browser or request testing can verify the finished handler.

WordPress Administration Interfaces

Covers admin pages, menus, forms, notices and other WordPress dashboard functionality.

How to use it: Ask “Add a settings page under the existing plugin menu and restrict it to administrators.” WP HoloDev can inspect the current admin structure, add the page and test it in the WordPress dashboard.

Settings API

Covers settings pages built using the WordPress Settings API.

How to use it: Ask “Add a checkbox setting using the Settings API and save it with the rest of this plugin's options.” WP HoloDev can wire up the setting, sanitisation and form output, then test that the value saves correctly.

Options API

Covers safe use of the WordPress Options API for persistent configuration.

How to use it: Ask “Store this setting as a WordPress option and make sure the value is sanitised before saving.” The skill helps the agent choose and use the appropriate Options API functions.

Transients API

Covers temporary cached data and when WordPress transients are appropriate.

How to use it: Ask “Cache this expensive API result for one hour using a transient and clear it when the related setting changes.” WP HoloDev can implement the cache and its invalidation rather than simply adding a transient without considering when it becomes stale.

WordPress Database Development

Covers database work through WordPress, including safe queries and use of the WordPress database layer.

How to use it: Ask “Review every query in this feature and fix any unsafe database access.” WP HoloDev can inspect the queries, apply the database skill and run security validation afterwards.

Custom Database Tables

Covers WordPress projects that need their own database tables, including schemas, creation and upgrades.

How to use it: Ask “Add a custom table for these records and include the upgrade path for existing installations.” WP HoloDev can design the schema, add the creation or migration code and test the installation path.

Custom Post Types

Covers creating and working with WordPress custom post types.

How to use it: Ask “Create a Books custom post type with these supported fields and these administrator labels.” WP HoloDev can register it and then verify that it appears and behaves correctly in WordPress.

Taxonomies

Covers custom taxonomies, terms and their relationships with WordPress content.

How to use it: Ask “Add a Genre taxonomy to the Books post type and make it hierarchical.” WP HoloDev can implement the taxonomy and test the resulting administration interface.

Blocks and Gutenberg

Covers WordPress block development and Gutenberg integrations.

How to use it: Ask “Build a block that displays this plugin's records and gives the editor these controls.” WP HoloDev can work across the PHP, JavaScript and block metadata required by the feature and then test the editor behaviour.

WordPress Cron

Covers scheduled tasks, recurring events, registration and cleanup.

How to use it: Ask “Run this cleanup task once per day and remove the scheduled event when the plugin is deactivated.” WP HoloDev can implement both the scheduled action and its lifecycle handling.

WP-CLI Development

Covers WordPress command-line workflows and custom WP-CLI commands.

How to use it: Ask “Add a WP-CLI command that rebuilds this plugin's index and reports how many records were processed.” WP HoloDev can create the command and run it in a test environment to confirm it works.

WordPress Multisite

Covers code that needs to work properly across WordPress multisite networks.

How to use it: Ask “Check whether this plugin is safe to network activate on multisite.” WP HoloDev can inspect assumptions about sites, options, activation and permissions and then test the relevant multisite behaviour where available.

Internationalisation

Covers translation-ready WordPress code, text domains and internationalisation.

How to use it: Ask “Check every user-facing string in this plugin and make it translation-ready.” WP HoloDev can inspect the PHP and interface strings and correct the implementation where required.

WooCommerce

Covers WordPress development work that interacts with WooCommerce.

How to use it: Describe the WooCommerce behaviour you need, for example, “Add this field to checkout, save it with the order and display it in the order admin screen.” WP HoloDev can use the WooCommerce skill together with normal project inspection and testing.

WordPress Performance

Covers slow queries, repeated work, poor caching and other causes of unnecessary WordPress overhead.

How to use it: Ask “Find out why this admin screen becomes slow with 10,000 records.” WP HoloDev can inspect the code path, identify likely bottlenecks and review the finished change for new performance problems.

WordPress Testing

Covers choosing useful automated, integration and browser tests for WordPress projects.

How to use it: Ask “Create a test plan for this feature before changing the code,” or “Prove this bug is fixed with a regression test.” The testing skill helps decide what evidence is needed, while the test tools actually run the checks.

Plugin and Theme Packaging

Covers preparing clean WordPress ZIP packages and making sure development-only files do not accidentally end up in a release.

How to use it: Ask “Prepare this plugin for distribution and make sure the ZIP contains only the files needed by the release.” WP HoloDev can validate the project first and then build the final package.

WordPress.org Submission

Covers the preparation and checks involved in getting a WordPress plugin ready for WordPress.org.

How to use it: Ask “Review this plugin for WordPress.org submission.” WP HoloDev can inspect the project, run relevant WordPress checks such as Plugin Check and identify work that needs to be completed before submission.

Specialist Agents

Some jobs are easier to review when a separate agent is given one specific responsibility. WP HoloDev can delegate part of a development job to a specialist agent without giving that specialist control of the entire project.

The main workflow gives the specialist a defined objective, the files it is allowed to inspect, the tools it may use and a resource budget. The specialist returns its findings to the main development process rather than becoming an unrestricted second developer.

Security Reviewer

Looks specifically for security problems in the code or in a proposed change.

How to use it: Ask “Have a separate security reviewer inspect this change before completion.” WP HoloDev can give the reviewer the relevant code and diff, collect its findings and return them to the main job for correction or acceptance.

Repository Mapper

Concentrates on understanding how an unfamiliar or complex codebase is organised before implementation starts.

How to use it: Ask “Map this plugin before making changes.” The repository mapper can inspect the project structure, identify important components and return that map to the main development agent.

Database Analyst

Concentrates on schemas, queries, data storage and database changes.

How to use it: Ask “Have the database analyst review the new schema and migration before we implement it.” The specialist can examine the proposed data changes independently and return problems or recommendations to the main job.

WPCS Reviewer

Reviews the WordPress implementation with particular attention to coding standards.

How to use it: Ask “Run an independent WPCS review before release.” The reviewer can inspect the changed code and validation results rather than simply accepting the primary agent's claim that the code follows WordPress standards.

Test Engineer

Concentrates on whether the work has been tested properly and whether the evidence is strong enough to accept the change.

How to use it: Ask “Have the test engineer independently verify this feature.” The specialist can review the requirements, choose appropriate tests, run permitted test tools and report whether the requested behaviour was actually proved.

REST Reviewer

Reviews WordPress REST API work with particular attention to routes, permissions, authentication, input and responses.

How to use it: After adding or changing a REST endpoint, ask “Have the REST reviewer inspect the final implementation.” The specialist can review the actual route and permission code independently of the agent that wrote it.

Performance Reviewer

Looks for unnecessary processing, inefficient queries and other performance problems introduced by the work.

How to use it: Ask “Run an independent performance review of this change.” This is particularly useful for frequently executed hooks, database-heavy features and code that must work with large amounts of content.

Release Verifier

Provides a separate final review before the project is packaged, distributed or deployed.

How to use it: Once implementation and normal validation have passed, ask “Have the release verifier perform the final release review.” The specialist can inspect the final state, validation evidence and release readiness before packaging proceeds.

Independent Code Reviewer

Reviews the actual code and diff instead of relying on the main coding agent's description of what it changed.

How to use it: Ask “Have an independent reviewer inspect the complete diff before this job is accepted.” The reviewer receives the relevant project state and reports its findings back to the main workflow so issues can be corrected before completion.

Using Skills in a Development Task

You do not need to turn a development request into a list of internal tools and skills. Tell WP HoloDev what the finished result should be and what evidence you want before accepting it. The harness can then assemble the project context, skills, tools and validation needed to carry out the job.

Example: Build a WordPress Plugin

Start with the outcome, for example: “Build a plugin that adds a private Notes post type with an administration screen. Follow WordPress Coding Standards, check the security, write the relevant tests and do not finish until Plugin Check and browser testing pass.” WP HoloDev can inspect the project, plan the implementation, edit the files, run the validators, test the WordPress interface and keep working if one of those checks fails.

Example: Investigate a Bug

Give WP HoloDev the problem and any reproduction steps you already know. For example: “Editors receive a permissions error when saving this form. Reproduce it first, find the actual cause, make the smallest change needed and run regression tests afterwards.” The harness can inspect the code, reproduce the failure, change the relevant files and then repeat the test to prove the bug is fixed.

Example: Review Security

Ask for a review with a clear scope, for example: “Review this plugin for WordPress security problems. Check permissions, nonces, input handling, output escaping, SQL, REST and AJAX. Do not change anything until you have shown me the findings.” WP HoloDev can combine WordPress security skills, deterministic checks and an independent security reviewer where appropriate.

Example: Prepare a Release

When development is finished, ask for the complete release process rather than simply requesting a ZIP. For example: “Prepare version 1.2.0 for release. Review the final diff, run the required validators and tests, run Plugin Check, build the release from the code that passed, generate the manifest and SHA-256 checksum, and stop if anything required fails.” WP HoloDev can then produce the package together with the evidence used to accept it.

Extensible by Design

The 60 built-in WordPress skills are not the end of the system. WP HoloDev can also work with skills from approved sources and individual projects, allowing a project to carry its own specialised development knowledge where that is useful.

A new skill does not get permission to do whatever it wants. It can describe how a task should be handled or request particular capabilities, but the harness still decides which files, tools, commands, network resources and other actions are actually allowed.

This means you can extend what WP HoloDev knows without turning every new instruction file into a new security boundary.

More Than a Coding Prompt

A good AI model can write code. That is useful, but it is only one part of development.

WP HoloDev gives the model the rest of the working environment: the project, WordPress skills, file access, development commands, testing, browser automation, validation, specialist reviewers, packaging and deployment. The harness then controls when those capabilities can be used and whether the evidence is good enough for the job to be considered complete.

The result is an AI WordPress development environment that can investigate a real project, make the required changes, test what it built and show you the evidence instead of simply handing back another block of generated code.