WordPress Releases Official 'agent-skills': Dedicated Guide Fixing Gutenberg Block Errors and Security Gaps in AI Coding

The WordPress team has released 'WordPress/agent-skills' on GitHub, a dedicated repository of guidelines and rules for AI coding assistants, including Claude Code and Codex. Having earned 2,200 GitHub stars, the repository provides a modular collection of agent skills engineered to teach AI coding agents WordPress standards, preventing chronic block invalidation errors and security oversights during real-world theme and plugin development.

Image source: X (@sexyguy)

As developers increasingly rely on terminal-based coding agents and large language models (LLMs) to write WordPress code, many encounter persistent errors stemming from outdated patterns. Because LLM training sets contain substantial volumes of pre-Gutenberg code, models frequently generate obsolete structures or omit essential backward-compatibility handling when modifying blocks. This causes WordPress's block editor to flag components with the familiar "This block is invalid" warning, breaking editor layouts. The official WordPress agent-skills repository directly addresses these entrenched habits by feeding agents explicit, up-to-date conventions.

Resolving Gutenberg Block Invalidation and 'This Block Is Invalid' Errors

The most prevalent issue developers face when using AI coding assistants in WordPress block environments is block validation failure.

When an editor post loads, Gutenberg reconciles stored block markup against the block's current definition. If attributes have changed without an accompanying compatibility handler for past versions, or if outdated code was generated, the editor fails validation and flags the block with an invalid content error.

• Enforcing Modern Block Standards: Guides agents to follow current WordPress block standards and structures instead of legacy pre-Gutenberg code patterns.
• Handling Block Migrations and Backward Compatibility: Explicitly directs agents through version compatibility rules so that modifications to existing blocks do not trigger 'invalid block' warnings in the editor.

By enforcing these constraints, the skills ensure that AI-generated blocks render cleanly in the WordPress admin interface and maintain editable state reliably.

Modular Architecture Across 10+ Skills: Project Detection, Security, and Automation

Rather than a single monolithic prompt, 'WordPress/agent-skills' is structured into more than ten modular, domain-specific instruction sets.

When an agent inspects a repository workspace, it is designed to automatically identify the type of WordPress project being worked on and call the appropriate specialized guidelines.

• Mandatory Plugin Security Standards: Directs agents to incorporate essential WordPress security practices by default, including user capability checks and rigorous input validation during plugin development.
• REST API Permission Enforcement: Prevents accidental exposure of unauthenticated custom endpoints by explicitly addressing permission verification when registering REST API routes.
• Repetitive CLI Automation: Includes command recipes for automating repetitive WordPress development tasks, reducing manual boilerplate friction.

The 'AI Draft, Human Review, AI Training' Pipeline and Practical Deployment Caveats

The engineering pipeline used to construct the repository itself reflects a noteworthy methodology. Using official WordPress documentation as the foundation, an AI model (Codex) drafted the initial rule specifications. Human contributors then thoroughly reviewed and corrected these definitions, creating a cycle where AI-drafted instructions are refined by people to train future AI assistants.

When adopting agent-skills in production environments, development teams should keep several practical nuances in mind:

• Harness Compatibility: The skills are designed for coding agent harnesses supporting the Agent Skills standard or context extensions (such as Claude Code and Codex). In generic web-based chat interfaces, skill documents must be manually copied into the prompt.
• Early Release Stage and Edge Cases: While gaining community traction with 2,200 stars, the repository represents an initial public release. Edge cases and errors encountered during real-world use continue to be refined through community feedback.
• Developer Oversight Responsibility: Although agent-skills enforces defensive security defaults and structural guidelines, final verification of complex custom database queries and external integrations remains the responsibility of the human developer.

For developers and engineering teams building products or maintaining sites on WordPress with the aid of AI coding agents, integrating this repository offers an immediate, structured safeguard against costly agent errors.

Sources

• GitHub: WordPress/agent-skills
• X (@sexyguy): WordPress agent-skills Overview and Real-World Usage Commentary