Claude Skills by adityaarsharma

Internationalization (i18n) audit for a WordPress plugin — checks every user-facing string is wrapped in `__()`/`_e()`/etc., text domain matches the plugin slug, POT file is fresh, locale-loading hook is on `init`/`plugins_loaded` (not earlier), placeholders use `%1$s` for translator-friendly word order, and pluralization uses `_n()`. Use when the user says "i18n", "translation", "POT", "text domain", "make plugin translatable", or before a release with new strings.

One-shot installer for every Orbit dependency — Node tooling, PHP CodeSniffer / WPCS / VIP / PHPCompatibility, PHPStan, Psalm, Rector, Playwright + browsers, Lighthouse, axe-core, WP-CLI, @wordpress/env, wp-now, WPScan, claude-mem, and 13 Claude Code skills. Use when the user says "install Orbit", "install power tools", "install everything", "missing tool", or any earlier skill flagged a `command not found` error.

Audit Interactivity API usage (WP 6.5+) — the modern way to add client-side dynamic behaviour to blocks without bundling React for the frontend. Catches plugins still using vanilla JS / jQuery / custom React mounts that should migrate. Use when the user says "Interactivity API", "wp-interactive", "modern dynamic block", "replace jQuery in block", or "frontend block JS".

IP / copyright clean-room audit for a WordPress plugin — when a plugin is built in the same space as a competitor whose code, zip, or WP.org download was studied, this scans the plugin so "understanding the flow" never becomes copying the work. Extracts the reference's reserved identifiers (text domain, function/class prefixes, custom hooks, option keys, REST namespaces, block names, shortcodes, handles), then scans OUR plugin for any of them leaking in, plus copied strings/readme/assets, GPL...

Audit `register_activation_hook` for safety + idempotency — does the hook handle multisite network-activate, does it create tables via `dbDelta` (not `CREATE TABLE`), does it gracefully handle re-activation (already-installed state), does it trigger expensive ops on activation that should be deferred. Use when the user says "activation hook", "register_activation_hook", "plugin install fails", "activation safety".

Audit downgrade / rollback safety — when a user reverts to an older plugin version (because the new one broke), does the older version handle data shaped for the newer version, do migration locks remain consistent, are tables / options forward-compatible. Use when the user says "rollback safety", "downgrade plugin", "rollback after broken release", or has a one-click rollback feature.

Audit version-upgrade migration logic — detect plugins that change schema / option shape between versions, verify migration runs once + is idempotent, verify version-tracking option exists, verify migrations cover every n→n+1 path. Use when the user says "version upgrade", "data migration", "schema change", "v1 → v2 path".

Lighthouse Core Web Vitals scoring for a WordPress plugin's frontend output and admin pages. Reports Performance, Accessibility, Best Practices, SEO scores with detailed breakdowns of LCP / FCP / TBT / CLS / TTI. Use when the user says "Lighthouse", "Core Web Vitals", "performance score", "LCP / CLS / TBT", "PageSpeed", or wants frontend perf metrics.

Search every public MCP registry and GitHub for MCP servers and Claude Code skills. Fans out across glama.ai (23,000+ servers), smithery.ai, mcp-get.com, npm, and GitHub simultaneously. Returns deduplicated, ranked results with install commands. Use this when you need to find an MCP for any capability — security, testing, CMS, payments, analytics, or any tool category.

Batch-test multiple WordPress plugins in parallel with CPU throttling. Run the full gauntlet against 5+ plugins simultaneously, each on its own wp-env site. Use when the user maintains a portfolio (e.g. The Plus Addons + example-plugin + example-plugin) and says "test all my plugins", "batch QA", "audit my whole portfolio".

Multisite (network) compatibility testing for a WordPress plugin — network activation, super-admin capability checks, per-site vs network-wide settings, sub-directory and sub-domain installs, switch_to_blog() safety, and uninstall on a network. Use when the user says "multisite", "network activation", "super admin", "WP MU", or before claiming "multisite compatible" in the plugin header.

Easy Digital Downloads license-server integration audit — license check + activation + deactivation, license key storage, expired-license handling, EDD Software Licensing API endpoints, plugin-update integration via EDD_SL_Plugin_Updater. Use when the user says "EDD license", "Software Licensing", "plugin update from EDD store", "license server".

Freemius SDK integration audit — opt-in flow, license check, plan switching, customer support, telemetry, GDPR / privacy disclosures, opt-out behaviour, Freemius vs alternative SDKs (EDD-SL). Use when the user says "Freemius integration", "Freemius SDK", "fs->is_paying", or has a freemium plugin.

PayPal integration audit — Smart Buttons (client SDK), REST API v2 (Orders + Payments), webhook signature verification (PAYPAL-AUTH-ALGO + PAYPAL-CERT-URL), IPN deprecation (use webhooks), sandbox vs live, currency restrictions per region. Use when the user says "PayPal integration", "Smart Buttons", "PayPal webhook", "IPN".

Stripe API integration audit — fetches Stripe's CURRENT API reference + recommended primitives + SCA rules AT RUNTIME. Auto-stays-current when Stripe ships new API versions / new primitives (e.g. Payment Element). Use when the user says "Stripe integration", "Stripe API", "PaymentIntent", "Payment Element", "Stripe webhook", "SCA / 3DS".

CDN compatibility audit (Cloudflare / BunnyCDN / KeyCDN / StackPath / native AWS CloudFront / Fastly) — verifies asset URLs work via CDN rewrite, immutable cache headers, query-string handling, cross-origin (CORS) headers for fonts, edge purging on plugin update. Use when the user says "CDN compat", "Cloudflare", "asset CDN", "edge cache", "CORS for fonts".

Detect PHP memory leaks in a WordPress plugin — runs the plugin's hot path N times in a single PHP process, measures `memory_get_usage()` after each iteration, flags linear growth (= leak). Catches plugins that grow memory across requests until OOM. Use when the user says "memory leak", "OOM", "memory grows", "PHP fatal: allowed memory exhausted".

Stress-test a WordPress plugin's hot endpoints with k6 / JMeter — concurrent users hitting login / cart / form-submit / REST endpoint, measuring p50 / p95 / p99 latency, error rate, throughput. Catches plugins that look fast on a single request but melt under 100 concurrent. Use when the user says "stress test", "load test", "k6", "JMeter", "100 concurrent users".

Playwright (browser automation) end-to-end suite for a WordPress plugin — first-time setup, write specs, run, watch (UI / headed / debug / trace viewer), HTML reporter. Covers admin pages, frontend output, block editor, login flow, settings forms. Use when the user says "Playwright", "E2E", "browser test", "headless", "trace viewer", "debug flaky test", or any first-time setup of E2E for their plugin.

Run the official WordPress.org `plugin-check` tool against your plugin — wraps the official WP-CLI command. Fetches the LATEST release at runtime, verifies the user's installed version is current, and runs the checks the WP.org review team uses. Use when the user says "plugin-check", "WP.org submission", "official checks", or before any release destined for wp.org.

Monthly competitor-pulse report — tracks competitor releases, version cadence, bundle weight changes, new features shipped, review-rating shifts. Cron-friendly, runs against your `qa.config.json` competitors list. Use when the user says "competitor pulse", "monthly competitor report", "what's the competition shipping".

Mine WP.org plugin reviews + support forum threads for action items. Pulls latest 50 reviews + open support topics, classifies by issue type (bug / feature request / UX complaint / performance / docs), summarises themes, and produces a prioritised list of "what users say is broken." Use when the user says "review mining", "what are users complaining about", "support themes", "feedback analysis".

Auto-draft release notes for a WordPress plugin from CHANGELOG.md + git diff + visual regression diffs. Generates user-facing announcement (blog post, email, in-plugin notice), readme.txt changelog, GitHub release notes, and a tweet-thread. Use when the user says "release notes", "draft announcement", "changelog → blog post", "what to write for v2.4".

Generate a RICE-scored backlog from any audit's findings — Reach × Impact × Confidence ÷ Effort. Reads `/orbit-gauntlet`, `/orbit-uat-compare`, `/orbit-pm-ux-audit` outputs, ranks every action item by RICE score, formats as PM-ready prioritised backlog. Use when the user says "RICE", "prioritise backlog", "PM scoring", "what should we fix first".

Extract a quarterly roadmap from a WordPress plugin codebase + audits + feedback — proposes a quarter-by-quarter plan based on RICE backlog, technical debt findings, competitor gaps, and user feedback. Use when the user says "draft roadmap", "Q3 plan", "what should we ship next quarter", "roadmap from audits".

PM-grade UX audit for a WordPress plugin's admin UI — three checks that catch the kind of quality issues that land in 1-star reviews. (1) Spell-check every visible string. (2) Guided Experience score (0-10, vs Yoast/WPForms/Elementor). (3) Label & terminology audit (vague buttons, PHP jargon, ambiguous toggles, illogical option ordering). Use when the user says "PM UX", "spell check labels", "guided experience score", "label benchmark", or wants the polish layer most plugins skip.

Install or troubleshoot the Orbit pre-commit hook in a WordPress plugin repo. Hook runs PHP lint on staged files, JSON validity check, scratch-pattern detector (var_dump/console.log/debugger), and a block.json apiVersion warning — all under 10 seconds. Use when the user says "install pre-commit", "block bad commits", "git hook for QA", or wants commit-time gating without slowing down their loop.

Stricter audit pass for Premium / paid WordPress plugins — Patchstack 2026 found 76% of premium-component vulns are exploitable (vs ~50% for free plugins). Premium code gets less security scrutiny + more attack interest. This skill runs a deeper rule set: license-server hardening, paid-only-feature gating, telemetry disclosure, premium-update channel security, anti-piracy logic review. Use when the user says "premium audit", "Pro plugin", "paid plugin checks", or runs against a Pro / paid pro...

Code coverage measurement for a WordPress plugin — line / branch / function coverage via PHPUnit + Xdebug or pcov, plus uncovered-file ranking. Catches files / functions never exercised by tests. Use when the user says "code coverage", "what's not tested", "coverage report", "PHPUnit coverage".

Manage a regression test pack — group every test that exists to prevent a previously-fixed bug from re-occurring. Tag tests with the issue/PR they came from, run only regression-pack tests for fast pre-merge verification, ensure every fixed bug has a regression test. Use when the user says "regression pack", "regression suite", "every bug needs a test", "fast pre-merge tests".

Clean stale Playwright visual snapshots — find PNGs in `__screenshots__/` that no test references anymore, find tests that have a snapshot per browser project but lost some over time, find snapshots that haven't been touched in 6+ months. Use when the user says "stale snapshots", "snapshot cleanup", "playwright screenshots accumulating", "clean screenshot dir".

Day-of-release sequence for a WordPress plugin. Runs 4 sequential gates — preflight (gauntlet-dry-run), release metadata check (header/readme.txt/version parity), full release-mode gauntlet, and evidence-pack generation. Outputs one HTML report bundle = the proof you actually shipped quality. Use when the user says "release this", "ship v2.0", "release gate", "WP.org submission", or has a `git tag` ready to go.

Validate the release metadata of a WordPress plugin — plugin header completeness, readme.txt validity (Stable tag, Tested up to, Requires PHP), version parity across all files, license compliance (GPL-compatible), POT file freshness, RTL stylesheet presence. Use when the user says "validate plugin header", "readme.txt check", "version parity", "Stable tag mismatch", "license check", or before tagging any release.

Generate the master HTML report index that ties together every Orbit output — gauntlet markdown, Playwright HTML, skill audit tabs, Lighthouse score card, UAT comparison, PM UX, version diff. One file, share-friendly. Use when the user says "generate report", "make HTML report", "share with PM", "release evidence pack", "master index".

Discover every `register_rest_route()` call in a WordPress plugin and fuzz-test each endpoint with malformed payloads, missing auth, oversized requests, type-juggling attacks, and SQLi/XSS injection vectors. Catches REST endpoint vulns most plugins ship. Use when the user says "REST API fuzzer", "fuzz endpoints", "REST security", "test REST permissions", or after adding any new `register_rest_route` call.

Audit a WordPress plugin for Real-Time Collaboration (RTC) compatibility — WP 7.0 ships RTC for the block editor; classic meta-boxes break it. Verifies plugin uses `register_post_meta()` + `PluginSidebar` instead of classic meta-boxes, declares sync-provider compatibility, doesn't write to post directly mid-edit. Use when the user says "RTC", "real-time collaboration", "WP 7.0 collab", "meta box collab", or has classic meta boxes that need to migrate.

Read a WordPress plugin's source code and generate human-readable QA scenarios plus draft Playwright test specs for its business logic. Use when the user asks to "generate tests for this plugin", "write test cases from code", "scaffold UAT scenarios", or invokes via scripts/scaffold-tests.sh --deep. Reviews-based approach — reads the actual code, infers user flows, outputs a concrete test plan.

Scan a WordPress plugin codebase + git history for hardcoded secrets — API keys, OAuth tokens, .env file leakage, password hashes, AWS keys, Stripe keys, Twilio tokens. Uses gitleaks-style entropy + regex detection. Use when the user says "secrets leak", "API key in code", "scan for secrets", "gitleaks", "before open-sourcing".

Supply-chain security audit — Composer + npm dependency CVE check, license compatibility (GPL-compatible only), abandoned package detection, typosquatting risk, lockfile integrity, post-install / preinstall scripts that smell like supply-chain attacks. Use when the user says "supply chain audit", "dependency CVE", "composer audit", "npm audit", "vendor security".

Active XSS probing for a WordPress plugin — sends DOM-based / reflected / stored XSS payloads to every form field, URL parameter, REST endpoint, AJAX action; checks if the payload renders unescaped or is reflected back. Use when the user says "XSS test", "active XSS", "stored XSS", "reflected XSS", "test for cross-site scripting".

Google PageSpeed Insights API integration — fetch Core Web Vitals (LCP, INP, CLS) for the live site URL from Google's CrUX dataset, compare your local Lighthouse score to real-user Field Data. Use when the user says "PageSpeed Insights", "PSI", "field data", "CrUX", "real-user metrics".

Audit Schema.org structured data output (JSON-LD) — required-vs-optional fields per type, Google Rich Results eligibility, validation against schema.org spec, coexistence with Yoast / RankMath. Use when the user says "schema markup", "structured data", "JSON-LD", "rich results", "schema.org".

Audit XML sitemap output — well-formed XML, sitemap-index for large sites (50K URL chunks), priority + changefreq usage, image / video / news sitemaps, robots.txt linkage, coexistence with Yoast / RankMath / WP core sitemaps. Use when the user says "sitemap", "XML sitemap", "search console sitemap", "Yoast sitemap conflict".

Guided onboarding wizard for Orbit. One-shot setup — installs all 45 skills, runs the power-tools installer, configures `qa.config.json` for the user's first plugin, spins up a wp-env Docker site, and runs a quick gauntlet so they see real output. Use whenever the user says "set up Orbit", "first time", "I'm new", "/orbit-setup", or runs Orbit on a machine that has no skills yet. Self-deletes nothing — leaves a clean palette of every Orbit command they need.

Meta-skill — generate a new `/orbit-*` skill following the Orbit pattern. Asks for the skill's purpose, scaffolds a SKILL.md with frontmatter + sections (purpose, quick start, what it checks, examples, output format, pair-with), and registers it in SKILLS.md. Use when the user says "add a skill", "create new orbit skill", "extend orbit", or has spotted a use case the existing 44 skills don't cover.

The action-mode meta-skill that REWRITES other Orbit skills. For every `~/.claude/skills/orbit-*/SKILL.md`, fetches the canonical sources listed in `Sources & Evergreen References`, diffs against embedded rules, proposes patches, and (with `--apply` or `--pr`) modifies the SKILL.md files. Replaces the read-only `/orbit-evergreen-update`. Use when the user says "improve skills", "skill-improver", "update orbit skills with current docs", "retrofit runtime-evergreen pattern", or quarterly + afte...

Natural-language UAT runner — Stagehand / Browser Use style. Reads the plugin code, infers user flows, generates plain-English test steps ("log in as admin → open Settings → fill API Key → save → verify saved"), executes via Playwright + AI-resolved selectors that survive UI changes. Self-heals when the DOM shifts. Use whenever the user wants UAT without writing specs, says "test my plugin", "run UAT", "natural language test", "auto-generate flows".

Side-by-side UAT comparison of two WordPress plugins on the same feature set. Generates an HTML report with paired PNG screenshots, MP4 flow videos, PM analysis per flow, RICE backlog, and a feature comparison table. Names files via the PAIR-NN-slug-a/b convention so the report auto-pairs by slug. Use when the user says "Plugin A vs Plugin B", "compare two plugins", "UAT report", "PAIR screenshots", "side-by-side", or "video comparison".

UAT (User Acceptance Testing) template + Playwright spec scaffolds specifically for Elementor addon plugins — drag widget into editor, configure via inspector, save, verify frontend output, test responsive breakpoints, test live preview, test in Elementor Pro Theme Builder context. Use when the user says "UAT for Elementor", "test my Elementor widget", "Elementor end-to-end".

UAT template + Playwright spec scaffolds for form plugins (Contact Form 7, WPForms, Gravity Forms, Forminator, Fluent Forms, etc.) — form rendering, field validation (client + server), submission flow, success / error notifications, anti-spam, file upload, multi-step, conditional logic, GDPR consent. Use when the user says "form plugin UAT", "test form submission", "spam protection test".