Skills

Public AI agent skills for WordPress development, JavaScript modernization, Azure infrastructure, architecture documentation, and pre-launch security audits.

Available Skills · Related Skills · Install · Usage · Invocation Strategy · Skill Notes

Available Skills

WordPress

Skills for WordPress plugin and theme development.

Skill	Purpose
prepare-wordpress	Scaffold or update a WordPress project with dev tooling, coding standards, testing, and i18n support.
wp-bump	Bump a WordPress plugin version and update related release metadata.
wp-cli-local	Run WP-CLI commands against Local by Flywheel sites on macOS.
wp-mutate	Run mutation testing on WordPress PHP and JavaScript to find weak tests, then triage surviving mutants.
wp-pcp-local	Run the WordPress Plugin Check (PCP) against Local by Flywheel sites on macOS.

JavaScript

Skills for JavaScript modernization and dependency audits.

Skill	Purpose
browser-native	Audit JavaScript dependencies and identify packages replaceable by modern browser/runtime native APIs, with Baseline status and confidence.

Azure

Skills for Azure infrastructure and API Management.

Skill	Purpose
add-apim-api	Scaffold a new API in Azure API Management with Bicep infrastructure.

Documentation

Skills for documenting repository architecture.

Skill	Purpose
document-architecture	Create, improve, or audit repository architecture and concept documentation.

Security

Skills for pre-launch security and abuse-resistance audits.

Skill	Purpose
pre-launch-security-audit	Run an evidence-backed security and abuse-resistance review before an application launch.

Related Skills (other repositories)

These live in their own repositories and install from there, not from soderlind/skills:

Skill	Purpose
use-just-bash-for-scripts	Steer the agent to dry-run generated or untrusted shell scripts through just-bash before touching the real host.

npx skills add soderlind/just-bash-runner

Install

Every skill installs with the skills CLI. -g installs globally, so the skill is available in every project.

Install all skills from this repository:

npx skills add soderlind/skills -g

Install a single skill — swap in any name from Available Skills:

npx skills add soderlind/skills --skill wp-bump -g

Add --all to install into every detected agent integration without prompts:

npx skills add soderlind/skills -g --all

Browse, list, update, and remove:

npx skills add soderlind/skills --list   # preview the skills in this repository
npx skills list -g                       # list installed skills
npx skills update wp-bump -g             # update one skill
npx skills remove wp-bump -g             # remove one skill

Discovery index

These skills are published as an Agent Skills discovery index (schema v0.2.0), so agents can enumerate and fetch them without the CLI:

curl https://soderlind.no/.well-known/agent-skills/index.json

Each entry carries a sha256: digest of its artifact — a single SKILL.md for skills with no supporting files, otherwise a .tar.gz of the skill directory. Clients must verify the digest before use and must not execute anything under scripts/ without explicit approval.

Regenerate the index and archives after changing any skill, then deploy the whole .well-known/agent-skills/ directory to the soderlind.no document root — it is self-contained, and every url in the index resolves inside it:

node scripts/build-agent-skills-index.mjs           # rebuild
node scripts/build-agent-skills-index.mjs --check   # fail if the committed output is stale (runs in CI)

The server must send application/json for index.json, application/gzip for .tar.gz, and text/markdown or text/plain for SKILL.md.

Archives are byte-reproducible (fixed mtimes, sorted entries), so unchanged skills produce unchanged digests. Use --base-url to point the index at a different origin:

node scripts/build-agent-skills-index.mjs --base-url https://example.com

Usage

After installation, ask your AI agent for the workflow you want. The matching skill should be selected automatically.

Example prompts:

Add a new API to Azure API Management for my backend service.
Run wp-cli on my Local site and list plugins.
Prepare this project for WordPress plugin development.
Bump this WordPress plugin to 1.2.3.
Run mutation testing on this plugin and show me which tests are weak.
Scan this JavaScript project for dependencies that can be replaced by native browser APIs.
Document the architecture of this repository for new contributors.
Run a pre-launch security audit on this application.

Invocation Strategy

Use model-invoked skills when autonomous triggering is important or when one skill should call another.

Use user-invoked skills when you want zero context load and explicit manual control.

When many user-invoked skills accumulate, add a lightweight router skill that maps tasks to the right skill so you do not rely on memory.

Skill Notes

add-apim-api

npx skills add soderlind/skills --skill add-apim-api -g

Use this to scaffold a new API in Azure API Management with Bicep infrastructure.

Prerequisites:

• Azure CLI with Bicep extension
• Existing APIM infrastructure project
• Access to the target Azure subscription

Example prompt:

Add a speeches-api to APIM with backend at https://api.example.com/speeches

The skill guides you through gathering requirements, creating Bicep files, and wiring up the API.

wp-cli-local

npx skills add soderlind/skills --skill wp-cli-local -g

Use this when working with WordPress sites in Local by Flywheel.

Prerequisites:

• macOS
• Local by Flywheel installed
• WP-CLI installed and available in PATH
• The target Local site is running

The skill always routes WP-CLI through its bundled wrapper:

bash skills/wp-cli-local/scripts/wp --list

wp-pcp-local

npx skills add soderlind/skills --skill wp-pcp-local -g

Use this to run the WordPress Plugin Check (PCP) against a plugin on a Local by Flywheel site.

Prerequisites:

• macOS
• Local by Flywheel installed
• WP-CLI installed and available in PATH
• The Plugin Check plugin installed and activated on the target site
• The target Local site is running

The skill routes Plugin Check through its bundled wrapper, auto-detecting the site and plugin slug from the current directory:

bash skills/wp-pcp-local/scripts/pcp my-plugin

prepare-wordpress

npx skills add soderlind/skills --skill prepare-wordpress -g

Use this to set up or refresh a WordPress project with common development tooling.

Prerequisites:

• Node.js 18+
• Composer 2+
• PHP 8.3+
• git
• WP-CLI for i18n commands

Preview the setup plan before changing a project (paths below assume a clone of this repo; when installed, use the skill's own directory):

node skills/prepare-wordpress/scripts/plan_setup.mjs --dry-run

Apply selected safe setup phases:

node skills/prepare-wordpress/scripts/plan_setup.mjs --apply --only=init,composer,config

wp-bump

npx skills add soderlind/skills --skill wp-bump -g

Use this for WordPress plugin releases. It updates existing version fields, changelog entries, build outputs, and test checks according to the target project.

Example prompt:

Run wp-bump for version 1.2.3.

The skill does not create commits, tags, or releases unless you explicitly ask your agent to do so.

wp-mutate

npx skills add soderlind/skills --skill wp-mutate -g

Use this to measure test quality rather than test coverage. Mutation testing changes your source in small ways and re-runs the suite; a mutant that survives marks a line that runs but is never asserted.

Prerequisites:

• An existing test suite. This skill does not create one — use prepare-wordpress first.
• PHP: Pest 3+ (native --mutate) or PHPUnit (Infection), plus Xdebug 3+ with xdebug.mode=coverage, or PCOV. Without a coverage driver Pest refuses to start.
• JavaScript: Vitest or Jest, for StrykerJS.

Five failure modes are specific to WordPress plugins, and each one produces a clean-looking run rather than an error. The skill checks for all of them:

• PCOV auto-detects pcov.directory and often picks an asset folder such as lib/, so every file reports 0.0% coverage.
• Pest's --everything enumerates classes via PSR-4, so WordPress class-*.php filenames are invisible to it. Scope with --path= instead.
• Pest's --parallel workers do not inherit -d ini flags, and mutants that time out are scored as killed — which can turn a real 60% into a reported 100%.
• Brain Monkey (via Patchwork) stops Infection's mutants from taking effect: the run either exits 0 with no summary or reports MSI 0%. The skill blocks that combination and routes you to Pest.
• StrykerJS copies Composer's vendor/ into its sandbox unless ignorePatterns says otherwise, then tries to parse PHP CodeSniffer's HTML fixtures.

Because all five look like ordinary output, the skill verifies the harness before reporting any score: mutants were created, at least one was killed, and the kills are not just time-outs.

Preview what the skill would run against (path assumes a clone of this repo; when installed, use the skill's own directory):

node skills/wp-mutate/scripts/detect_mutation_setup.mjs

Example prompt:

Run mutation testing on this plugin and show me which tests are weak.

The skill reports two scores (overall and covered-code only), ranks surviving mutants with untested security controls first, and proposes assertions one at a time rather than rewriting tests on its own; see references/triage-playbook.md for the mutant-to-assertion mapping and references/glossary.md for the engine vocabulary differences.

browser-native

npx skills add soderlind/skills --skill browser-native -g

Use this to scan JavaScript/Node.js dependencies and find packages that can be replaced with built-in APIs (fetch, URL, structuredClone, crypto.randomUUID, Intl, Object.groupBy, Set methods, <dialog>/Popover API, etc.).

Each finding carries a confidence level (does the native API do what the library does?) and a Baseline status (can your users run it? — widely / newly / limited), so you can tell the easy wins from swaps that need an audience check or a fallback.

Run the local scanner directly (path assumes a clone of this repo; when installed, use the skill's own directory):

node skills/browser-native/scripts/cli.js .

Markdown report with before/after examples:

node skills/browser-native/scripts/cli.js . --md

document-architecture

npx skills add soderlind/skills --skill document-architecture -g

Use this to create, improve, or audit repository architecture and concept documentation (architecture overviews, domain models, component boundaries, data/control flows, invariants, ADRs).

Example prompt:

Document the architecture of this repository so a new contributor can navigate it.

The skill labels current vs. proposed states explicitly and verifies claims against the repository before writing docs; see references/templates.md for document templates.

pre-launch-security-audit

npx skills add soderlind/skills --skill pre-launch-security-audit -g

Use this to run a stack-agnostic security and abuse-resistance review before launching an application (MVP, SaaS, AI app, public API, or mobile backend).

Example prompt:

Run a pre-launch security audit on this app before we go live.

The skill inspects the repository first, tests failure cases, and ends with a launch recommendation (block, conditional, or baseline met) rather than a compliance certification; see references/checklist.md for the control set.

Repository Layout

Each skill lives in its own folder under skills/:

.well-known/
  agent-skills/            # generated discovery index + skill archives
scripts/
  build-agent-skills-index.mjs
skills/
  add-apim-api/
    SKILL.md
    references/
  browser-native/
    SKILL.md
    references/
    scripts/
  prepare-wordpress/
    SKILL.md
    references/
    scripts/
  wp-bump/
    SKILL.md
  wp-cli-local/
    SKILL.md
    scripts/
  wp-mutate/
    SKILL.md
    references/
    scripts/
  wp-pcp-local/
    SKILL.md
    scripts/
  document-architecture/
    SKILL.md
    agents/
    references/
  pre-launch-security-audit/
    SKILL.md
    agents/
    references/

Licenses

All skills in this repository are licensed under the MIT License.

AI Contribution Attribution

Assisted-by: GitHub Copilot:GPT-5.3-Codex