Skills

Public AI agent skills for WordPress development, JavaScript modernization, Azure infrastructure, architecture documentation, and pre-launch security audits.

Available Skills · Related Skills · Install · Usage · Invocation Strategy · Skill Notes

Skills for WordPress plugin and theme development.

Skills for JavaScript modernization and dependency audits.

Skills for Azure infrastructure and API Management.

Skills for documenting repository architecture.

Skills for pre-launch security and abuse-resistance audits.

These live in their own repositories and install from there, not from soderlind/skills:

npx skills add soderlind/just-bash-runner

Every skill installs with the skills CLI. -g installs globally, so the skill is available in every project.

Install all skills from this repository:

npx skills add soderlind/skills -g

Install a single skill — swap in any name from Available Skills:

npx skills add soderlind/skills --skill wp-bump -g

Add --all to install into every detected agent integration without prompts:

npx skills add soderlind/skills -g --all

Browse, list, update, and remove:

npx skills add soderlind/skills --list   # preview the skills in this repository
npx skills list -g                       # list installed skills
npx skills update wp-bump -g             # update one skill
npx skills remove wp-bump -g             # remove one skill

These skills are published as an Agent Skills discovery index (schema v0.2.0), so agents can enumerate and fetch them without the CLI:

curl https://soderlind.no/.well-known/agent-skills/index.json

Each entry carries a sha256: digest of its artifact — a single SKILL.md for skills with no supporting files, otherwise a .tar.gz of the skill directory. Clients must verify the digest before use and must not execute anything under scripts/ without explicit approval.

Regenerate the index and archives after changing any skill, then deploy the whole .well-known/agent-skills/ directory to the soderlind.no document root — it is self-contained, and every url in the index resolves inside it:

node scripts/build-agent-skills-index.mjs           # rebuild
node scripts/build-agent-skills-index.mjs --check   # fail if the committed output is stale (runs in CI)

The server must send application/json for index.json, application/gzip for .tar.gz, and text/markdown or text/plain for SKILL.md.

Archives are byte-reproducible (fixed mtimes, sorted entries), so unchanged skills produce unchanged digests. Use --base-url to point the index at a different origin:

node scripts/build-agent-skills-index.mjs --base-url https://example.com

After installation, ask your AI agent for the workflow you want and the matching skill is selected automatically. You can also target a skill directly with a slash command — /<skill-name> — optionally passing arguments, e.g. /prepare-wordpress i18n to run just the i18n phase.

Example invocations:

/add-apim-api speeches-api backend https://api.example.com/speeches
/wp-cli-local list plugins
/prepare-wordpress i18n
/wp-bump 1.2.3
/wp-mutate
/browser-native
/document-architecture
/pre-launch-security-audit

Use model-invoked skills when autonomous triggering is important or when one skill should call another.

Use user-invoked skills when you want zero context load and explicit manual control.

When many user-invoked skills accumulate, add a lightweight router skill that maps tasks to the right skill so you do not rely on memory.

npx skills add soderlind/skills --skill add-apim-api -g

Use this to scaffold a new API in Azure API Management with Bicep infrastructure.

Prerequisites:

• Azure CLI with Bicep extension
• Existing APIM infrastructure project
• Access to the target Azure subscription

Example prompt:

/add-apim-api speeches-api backend https://api.example.com/speeches

The skill guides you through gathering requirements, creating Bicep files, and wiring up the API.

npx skills add soderlind/skills --skill wp-cli-local -g

Use this when working with WordPress sites in Local by Flywheel.

Prerequisites:

• macOS
• Local by Flywheel installed
• WP-CLI installed and available in PATH
• The target Local site is running

The skill always routes WP-CLI through its bundled wrapper:

bash skills/wp-cli-local/scripts/wp --list

npx skills add soderlind/skills --skill wp-pcp-local -g

Use this to run the WordPress Plugin Check (PCP) against a plugin on a Local by Flywheel site.

Prerequisites:

• macOS
• Local by Flywheel installed
• WP-CLI installed and available in PATH
• The Plugin Check plugin installed and activated on the target site
• The target Local site is running

The skill routes Plugin Check through its bundled wrapper, auto-detecting the site and plugin slug from the current directory:

bash skills/wp-pcp-local/scripts/pcp my-plugin

npx skills add soderlind/skills --skill prepare-wordpress -g

Use this to set up or refresh a WordPress project with common development tooling.

Example prompt (pass a phase name to run just that phase):

/prepare-wordpress i18n

Prerequisites:

• Node.js 18+
• Composer 2+
• PHP 8.3+
• git
• WP-CLI for i18n commands

Preview the setup plan before changing a project (paths below assume a clone of this repo; when installed, use the skill's own directory):

node skills/prepare-wordpress/scripts/plan_setup.mjs --dry-run

Apply selected safe setup phases:

node skills/prepare-wordpress/scripts/plan_setup.mjs --apply --only=init,composer,config

Available phases (pass any comma-separated subset to --only= or --skip=):

npx skills add soderlind/skills --skill wp-bump -g

Use this for WordPress plugin releases. It updates existing version fields, changelog entries, build outputs, and test checks according to the target project.

Example prompt:

/wp-bump 1.2.3

The skill does not create commits, tags, or releases unless you explicitly ask your agent to do so.

npx skills add soderlind/skills --skill wp-mutate -g

Use this to measure test quality rather than test coverage. Mutation testing changes your source in small ways and re-runs the suite; a mutant that survives marks a line that runs but is never asserted.

Prerequisites:

• An existing test suite. This skill does not create one — use prepare-wordpress first.
• PHP: Pest 3+ (native --mutate) or PHPUnit (Infection), plus Xdebug 3+ with xdebug.mode=coverage, or PCOV. Without a coverage driver Pest refuses to start.
• JavaScript: Vitest or Jest, for StrykerJS.

Five failure modes are specific to WordPress plugins, and each one produces a clean-looking run rather than an error. The skill checks for all of them:

• PCOV auto-detects pcov.directory and often picks an asset folder such as lib/, so every file reports 0.0% coverage.
• Pest's --everything enumerates classes via PSR-4, so WordPress class-*.php filenames are invisible to it. Scope with --path= instead.
• Pest's --parallel workers do not inherit -d ini flags, and mutants that time out are scored as killed — which can turn a real 60% into a reported 100%.
• Brain Monkey (via Patchwork) stops Infection's mutants from taking effect: the run either exits 0 with no summary or reports MSI 0%. The skill blocks that combination and routes you to Pest.
• StrykerJS copies Composer's vendor/ into its sandbox unless ignorePatterns says otherwise, then tries to parse PHP CodeSniffer's HTML fixtures.

Because all five look like ordinary output, the skill verifies the harness before reporting any score: mutants were created, at least one was killed, and the kills are not just time-outs.

Preview what the skill would run against (path assumes a clone of this repo; when installed, use the skill's own directory):

node skills/wp-mutate/scripts/detect_mutation_setup.mjs

Example prompt:

/wp-mutate

The skill reports two scores (overall and covered-code only), ranks surviving mutants with untested security controls first, and proposes assertions one at a time rather than rewriting tests on its own; see references/triage-playbook.md for the mutant-to-assertion mapping and references/glossary.md for the engine vocabulary differences.

npx skills add soderlind/skills --skill browser-native -g

Use this to scan JavaScript/Node.js dependencies and find packages that can be replaced with built-in APIs (fetch, URL, structuredClone, crypto.randomUUID, Intl, Object.groupBy, Set methods, <dialog>/Popover API, etc.).

Each finding carries a confidence level (does the native API do what the library does?) and a Baseline status (can your users run it? — widely / newly / limited), so you can tell the easy wins from swaps that need an audience check or a fallback.

Example prompt:

/browser-native

Run the local scanner directly (path assumes a clone of this repo; when installed, use the skill's own directory):

node skills/browser-native/scripts/cli.js .

Markdown report with before/after examples:

node skills/browser-native/scripts/cli.js . --md

npx skills add soderlind/skills --skill document-architecture -g

Use this to create, improve, or audit repository architecture and concept documentation (architecture overviews, domain models, component boundaries, data/control flows, invariants, ADRs).

Example prompt:

/document-architecture

The skill labels current vs. proposed states explicitly and verifies claims against the repository before writing docs; see references/templates.md for document templates.

npx skills add soderlind/skills --skill pre-launch-security-audit -g

Use this to run a stack-agnostic security and abuse-resistance review before launching an application (MVP, SaaS, AI app, public API, or mobile backend).

Example prompt:

/pre-launch-security-audit

The skill inspects the repository first, tests failure cases, and ends with a launch recommendation (block, conditional, or baseline met) rather than a compliance certification; see references/checklist.md for the control set.

Each skill lives in its own folder under skills/:

.well-known/
  agent-skills/            # generated discovery index + skill archives
scripts/
  build-agent-skills-index.mjs
skills/
  add-apim-api/
    SKILL.md
    references/
  browser-native/
    SKILL.md
    references/
    scripts/
  prepare-wordpress/
    SKILL.md
    references/
    scripts/
  wp-bump/
    SKILL.md
  wp-cli-local/
    SKILL.md
    scripts/
  wp-mutate/
    SKILL.md
    references/
    scripts/
  wp-pcp-local/
    SKILL.md
    scripts/
  document-architecture/
    SKILL.md
    agents/
    references/
  pre-launch-security-audit/
    SKILL.md
    agents/
    references/

All skills in this repository are licensed under the MIT License.

Assisted-by: GitHub Copilot:GPT-5.3-Codex