wp-performance-review
Queries, caching, cron, asset loading, and request-level bottlenecks.
14 review domains • 28 Claude commands • Parallel Codex wrappers
A developer-focused skill pack for Claude Code and Codex across performance, security, plugins, blocks, themes, WooCommerce, REST APIs, admin UI, migrations, accessibility, testing, WP-CLI ops, Playground, and PHPStan.
The pack is designed for real WordPress codebases, not toy examples. It keeps the review flow opinionated and practical, with clear severity, file-level guidance, and cross-skill handoffs when a finding belongs in a different domain.
Available Skills
Each skill is built to handle a clear slice of WordPress development so the model can review with more precision and less generic advice.
Queries, caching, cron, asset loading, and request-level bottlenecks.
XSS, SQL injection, CSRF, authorization gaps, and unsafe uploads.
Lifecycle hooks, Settings API, structure, i18n, and WordPress.org patterns.
block.json, editor logic, render callbacks, deprecations, and Interactivity API.
theme.json, templates, FSE patterns, template parts, and style variations.
HPOS, CRUD APIs, gateways, cart fragments, template overrides, and scheduling.
Custom routes, permission callbacks, schema design, validation, and response shape.
Settings screens, admin menus, notices, screen targeting, and admin UX structure.
Version guards, dbDelta(), schema changes, backfills, and rollout safety.
Semantic markup, keyboard support, focus management, labels, and ARIA usage.
Unit, integration, and E2E test selection for risky WordPress changes.
Custom CLI commands, multisite operations, search-replace safety, and maintenance runbooks.
Blueprints, reproducible demos, Playground CLI workflows, and zero-setup bug repros.
PHPStan config, baselines, CI wiring, WordPress stubs, and practical static-analysis rollout.
Installation
The primary flow is project install, but the site also covers user-account installs, one-skill installs, and the shared-reference setup Codex wrappers need.
Slash Commands
Every domain includes a deeper review command and a faster triage command so you can start broad or go straight into specifics.
Full performance review with grouped findings.
Fast scan for critical performance issues.
Full security audit for exploitable patterns.
Quick security triage.
Full plugin architecture and standards review.
Quick plugin structure scan.
Full Gutenberg block review.
Quick block API scan.
Full block or classic theme review.
Quick theme and FSE scan.
Full WooCommerce extension review.
Quick WooCommerce compatibility scan.
Full REST API review.
Quick route and permission scan.
Full admin UI review.
Quick admin screen scan.
Full migration and upgrade review.
Quick migration risk scan.
Full accessibility review.
Quick semantic and keyboard scan.
Full test strategy review.
Quick coverage and gap scan.
Full WP-CLI and operations review.
Quick operational risk scan.
Full Playground review.
Quick Blueprint and repro scan.
Full PHPStan review.
Quick static-analysis scan.
Natural Language Usage
The pack is designed so people can ask for a review the way they actually think about the problem instead of memorizing a wall of commands.
Review this plugin for performance issues
Audit this theme for security problems
Help me debug this block.json setup
Check this WooCommerce extension for HPOS issues
Review these custom REST routes
Check this plugin settings page
Audit this release migration before deploy
Review this theme for accessibility issues
What tests should I add for this change?
Coverage
A quick way to understand where each domain starts, what it looks for, and how the pack avoids collapsing every review into one vague checklist.
Database query anti-patterns, cache strategy, cron misuse, asset loading, N+1 patterns, and slow hooks.
Output escaping, prepared queries, nonces, capability checks, upload handling, and dangerous functions.
Plugin structure, activation and uninstall flows, Settings API, CPTs, taxonomies, i18n, and standards readiness.
block.json, editor logic, save behavior, render callbacks, deprecations, and Interactivity API.
theme.json, template hierarchy, style variations, block patterns, and classic-to-block migration.
HPOS, CRUD APIs, gateways, template overrides, cart fragments, and Action Scheduler.
Route registration, permission callbacks, request validation, schema handling, and response design.
Settings pages, admin menus, notices, screen targeting, and capability-aware admin flows.
Versioned upgrades, schema changes, backfills, batching, and rollout risk.
Semantic HTML, keyboard access, focus management, labels, ARIA, and interactive accessibility.
Unit, integration, and E2E strategy, existing coverage discovery, and regression prioritization.
Repository Layout
claude-skills/ # Claude-oriented skill pack with shared reference docs
codex-skills/ # Codex-oriented skill wrappers for the same fourteen domains
commands/ # Claude slash commands
public/ # README assets
docs/ # GitHub Pages site