Skills wp-playground
📦

wp-playground

Content revision r1 Medium Risk 🌐 Network access⚙️ External commands📁 Filesystem access

Launch WordPress Playground Test Sites

WordPress testing often needs a fast site without Docker or hosting. This skill guides Claude, Codex, and Claude Code through Playground URLs, blueprints, CLI usage, and demos.

Supports: Claude Codex Code(CC)
⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "wp-playground" from https://skillstore.io/skills/crazyswami-wp-playground.md and its manifest at https://skillstore.io/api/skills/crazyswami-wp-playground/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/crazyswami-wp-playground.md Signed manifest GET /api/skills/crazyswami-wp-playground/manifest Signed lockfile GET /api/skills/crazyswami-wp-playground/lockfile

Test it

Using "wp-playground". Create a temporary site for plugin testing.

Expected outcome:

A setup plan with selected versions, required plugins, launch method, test steps, and cleanup notes.

Using "wp-playground". Prepare a WooCommerce client demo.

Expected outcome:

A demo checklist covering store settings, theme choice, required extensions, sample content, and sharing approach.

Using "wp-playground". Review a Playground command before running it.

Expected outcome:

A risk summary that flags npm execution, mounted folders, remote blueprints, and safer alternatives.

Security Audit

Medium Risk
v8 • 7/5/2026 Open versioned report

Most static hits are Markdown formatting or official WordPress Playground documentation URLs, and the hidden ~/.claude path is a false positive. Confirmed risks are expected but meaningful: npx CLI execution, WordPress plugin/theme installation, PHP or WP-CLI blueprint steps, remote blueprint loading, and broad local directory mounting.

3
Files scanned
519
Lines analyzed
16
Review items
0
False positives ignored

Confirmed security concerns (2)

Medium
SKILL.md:55-66SKILL.md:245-246
Remote Blueprint Trust Warning Missing
The skill shows loading a remote blueprint URL while documenting blueprint steps that can run PHP, run WP-CLI, and write files. Users need an explicit warning to review remote blueprints before use.
The remote blueprint URL example is clear, and the same file lists powerful blueprint steps. The issue is missing trust guidance, not hidden malicious intent.
Medium
SKILL.md:197-198SKILL.md:213-220SKILL.md:306-308
Broad Local Directory Mounting Warning Missing
The skill recommends auto-mounting the current directory and mounting local plugin or theme paths without warning users to avoid secrets or broad project roots.
The mount commands and auto-mount workflow are explicit. The risk depends on the working directory contents, so confidence is high but not absolute.
Capability review items (16)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
SKILL.md:19-28
Ruby/shell backtick execution
```bash
The bash block advises running npx @wp-playground/cli, which can download and execute an npm package and start a local server. This is expected functionality but still external command execution.
Medium
SKILL.md:59
Ruby/shell backtick execution
| `installPlugin` | Install plugin from wp.org | `{"step":"installPlugin","pluginData":{"resource":"
The table documents installing WordPress plugins from wp.org, which can introduce third-party PHP code into the Playground site. It is legitimate but should be treated as supply-chain execution in a sandbox.
Medium
SKILL.md:60
Ruby/shell backtick execution
| `installTheme` | Install theme from wp.org | `{"step":"installTheme","themeData":{"resource":"word
The table documents installing themes from wp.org, which can introduce third-party code into the Playground site. The action is sandboxed but still executes external WordPress code.
Medium
SKILL.md:63
Ruby/shell backtick execution
| `runPHP` | Execute PHP code | `{"step":"runPHP","code":"<?php echo 'Hello'; ?>"}` |
The runPHP blueprint step executes PHP code inside the WordPress Playground environment. It is sandboxed, but untrusted blueprint code would still run during setup.
Medium
SKILL.md:64
Ruby/shell backtick execution
| `wp-cli` | Run WP-CLI command | `{"step":"wp-cli","command":"plugin list"}` |
The wp-cli blueprint step runs WordPress CLI commands inside the Playground environment. It is expected functionality but can change site state or install code when used with untrusted input.
Medium
SKILL.md:65
Ruby/shell backtick execution
| `writeFile` | Create/modify file | `{"step":"writeFile","path":"/index.html","data":"content"}` |
The writeFile blueprint step can create or modify files in the Playground filesystem. The risk is limited unless directories are mounted, but it is still a file-changing action.
Medium
SKILL.md:76-116
Ruby/shell backtick execution
```json
The documented development blueprint installs and activates multiple WordPress plugins from wp.org. This is normal for the skill, but it executes third-party plugin code in the test environment.
Medium
SKILL.md:120-142
Ruby/shell backtick execution
```json
The WooCommerce blueprint installs and activates a plugin and theme from wp.org. This is expected demo setup but introduces external WordPress code into the environment.
Medium
SKILL.md:146-173
Ruby/shell backtick execution
```json
The theme development blueprint installs a theme and plugins from wp.org. This is expected but still loads external WordPress code into the Playground environment.
Medium
SKILL.md:181-199
Ruby/shell backtick execution
```bash
The bash examples run npx @wp-playground/cli and include auto-mounting the current directory. This can execute npm code and expose local files to the Playground server.
Medium
SKILL.md:203-209
Ruby/shell backtick execution
```bash
The bash block runs npx @wp-playground/cli to build and serve snapshots. This is legitimate but still invokes external CLI code on the host.
Medium
SKILL.md:213-221
Ruby/shell backtick execution
```bash
The bash block mounts local plugin or theme directories into the Playground server. This can expose or modify local project files if used on the wrong path.
Medium
SKILL.md:255-279
Ruby/shell backtick execution
```javascript
The JavaScript API example runs a wp-cli step inside Playground. This is sandboxed but shows programmatic command execution in the WordPress environment.
Medium
SKILL.md:288-308
Ruby/shell backtick execution
2. Run `npx @wp-playground/cli server --blueprint=./test-blueprint.json`
The workflow tells users to run npx @wp-playground/cli with a blueprint file. That invokes external CLI code and executes blueprint steps, so review is required.
Medium
SKILL.md:308-347
Ruby/shell backtick execution
1. Use `--auto-mount` to mount current directory
The workflow advises --auto-mount for the current directory. This can expose more local files than intended if run from a broad project root.
Low
SKILL.md:246
Hardcoded URL
https://playground.wordpress.net/?blueprint-url=https://example.com/blueprint.json
The example teaches loading a remote blueprint URL, and blueprints can include setup actions such as PHP, WP-CLI, and file writes. This is legitimate but should warn users to trust the remote source.

Risk Factors

🌐 Network access (14)
blueprints/base.json:2 blueprints/woocommerce.json:2 SKILL.md:15 SKILL.md:40 SKILL.md:78 SKILL.md:122 SKILL.md:148 SKILL.md:231 SKILL.md:234 SKILL.md:237 SKILL.md:240 SKILL.md:243 SKILL.md:246 SKILL.md:336
⚙️ External commands (33)
SKILL.md:19-28 SKILL.md:28-38 SKILL.md:38-53 SKILL.md:53-59 SKILL.md:59 SKILL.md:60 SKILL.md:61 SKILL.md:62 SKILL.md:63 SKILL.md:64 SKILL.md:65 SKILL.md:66 SKILL.md:76-116 SKILL.md:116-120 SKILL.md:120-142 SKILL.md:142-146 SKILL.md:146-173 SKILL.md:173-181 SKILL.md:181-199 SKILL.md:199-203 SKILL.md:203-209 SKILL.md:209-213 SKILL.md:213-221 SKILL.md:221-229 SKILL.md:229-247 SKILL.md:247-255 SKILL.md:255-279 SKILL.md:279-288 SKILL.md:288-308 SKILL.md:308-347 SKILL.md:347-349 SKILL.md:349-350 SKILL.md:350-351
📁 Filesystem access (2)
SKILL.md:347 SKILL.md:347
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/crazyswami-wp-playground/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/crazyswami-wp-playground/security.svg)](https://skillstore.io/skills/crazyswami-wp-playground?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/crazyswami-wp-playground?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/crazyswami-wp-playground/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/crazyswami-wp-playground.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

CrazySwami. (2026). wp-playground security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/crazyswami-wp-playground/audits/8

BibTeX citation

@techreport{crazyswami-crazyswami-wp-playground-2026, author = {CrazySwami}, title = {wp-playground security audit report (audit version 8)}, institution = {Skillstore}, year = {2026}, number = {8}, url = {https://skillstore.io/skills/crazyswami-wp-playground/audits/8}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "wp-playground security audit report (audit version 8)" version: "unspecified" type: report authors: - name: "CrazySwami" date-released: "2026-07-05" url: "https://skillstore.io/skills/crazyswami-wp-playground/audits/8" identifiers: - type: other value: "skillstore:crazyswami-wp-playground:audit:8" description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score
Automattic Recommended

automattic-wp-playground

Skillstore Score 66
Evidence Confidence High
Skillstore usage 7
Updated

2026-08-21

CrazySwami Current

crazyswami-wp-playground

Skillstore Score 50
Evidence Confidence High
Skillstore usage 7
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
85
Maintainability
87
Content
71
Community
83
Spec Compliance

What You Can Build

Run Plugin Smoke Tests

Create a disposable site, install a plugin, test key screens, and close the environment after review.

Prepare WooCommerce Demos

Start a temporary store with WooCommerce, Storefront, SEO tooling, and basic store settings.

Preview Theme Changes

Mount a local theme folder and inspect changes in a browser without a full server stack.

Try These Prompts

Start a Clean Test Site 
Use the wp-playground skill to start a basic WordPress Playground site. Choose browser access unless I ask for CLI.
Build a Plugin Test Blueprint 
Create a WordPress Playground blueprint plan for testing [plugin slug]. Include versions, login behavior, plugins, and site options.
Prepare a WooCommerce Demo 
Use the WooCommerce blueprint pattern to plan a temporary store demo. Include plugins, theme choice, store settings, and demo steps.
Review a Playground Workflow 
Audit this Playground command or blueprint before I run it: [paste details]. Identify network access, mounted paths, and unsafe steps.

Best Practices

  • Review every blueprint before running it, especially runPHP, wp-cli, writeFile, and remote blueprint URLs.
  • Use a minimal test directory when mounting local code.
  • Pin WordPress, PHP, plugin, and CLI versions when reproducing bugs.

Avoid

  • Do not load remote blueprints from sources you do not trust.
  • Do not auto-mount a project root that contains secrets or private data.
  • Do not treat Playground performance or email behavior as production-equivalent.

Frequently Asked Questions

Does this skill require Docker?
No. WordPress Playground runs in a browser or through the Playground CLI without a Docker stack.
Can it test WooCommerce?
Yes. The skill includes a WooCommerce blueprint pattern with WooCommerce, Storefront, SEO tooling, and store settings.
Does it run local commands?
It can guide CLI commands that use npx. Review each command before running it.
Will site data persist?
Not by default. Export a snapshot or use a saved environment when you need repeatable state.
Can it use local plugin or theme files?
Yes. The CLI examples mount local directories, so use a limited folder without secrets.
Is this suitable for production sites?
No. Use it for testing, demos, and temporary previews, not production hosting.

Developer Details

Author

CrazySwami

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/CrazySwami/wordpress-dev-skills/tree/main/skills/wp-playground

Ref

02f077c174c5335e2f5d02ca15e77b70d9543e58

Maintenance freshness

7/18/2026

Usage

4 downloads · 278 views

File structure

📁 blueprints/

📄 base.json

📄 woocommerce.json

📄 SKILL.md

More from CrazySwami

View all

Related Skills

View all