·
Last changedVersion:
This version passed the hardening gate. The skill content was retained without changes. Classified findings before hardening: 1. Classified findings closed: 0. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 0. Review findings remaining: 10.
1
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Prompt Injection | Third-party content as instructions | Low | Open |
1 finding
Use this skill when the user mentions:
@wordpress/interactivity,data-wp-interactive, data-wp-on--*, data-wp-bind--*, data-wp-context,viewScriptModule / module-based view scripts,wp-project-triage).Search for:
data-wp-interactive@wordpress/interactivityviewScriptModuleDecide:
block.json view script module?If you’re creating a new interactive block (not just debugging), prefer the official scaffold template:
@wordpress/create-block-interactive-template (via @wordpress/create-block)Locate store definitions and confirm:
data-wp-on--*.Pre-render HTML on the server before outputting to ensure:
For components using block.json, add supports.interactivity:
For themes/plugins without block.json, use wp_interactivity_process_directives() to process directives.
Use wp_interactivity_state() to define initial global state:
For local context, use wp_interactivity_data_wp_context():
When derived state affects initial HTML rendering, replicate the logic in PHP:
This ensures directives like data-wp-bind--hidden="!state.hasItems" render correctly on first load.
For detailed examples and patterns, see references/server-side-rendering.md.
When touching markup directives:
WordPress 6.9 changes:
data-wp-ignore is deprecated and will be removed in future versions. It broke context inheritance and caused issues with client-side navigation. Avoid using it.--- separator (e.g., data-wp-on--click---plugin-a="..." and data-wp-on--click---plugin-b="...").AsyncAction<ReturnType> and TypeYield<T> help with async action typing.For quick directive reminders, see references/directives-quickref.md.
Verify the repo supports the required module build path:
@wordpress/scripts, prefer its conventions.If “nothing happens” on interaction:
viewScriptModule is enqueued/loaded,data-wp-interactive,See references/debugging.md.
wp-project-triage indicates signals.usesInteractivityApi: true after your change (if applicable).data-wp-interactive.wp_interactivity_state() with closures.supports.interactivity not set in block.json (for blocks).wp_interactivity_process_directives() not called (for themes/plugins).state.hasItems missing on server, causing hidden attribute to be absent.getServerState() and getServerContext() now reset between page transitions—ensure your code doesn't assume stale values persist.attachTo for rendering overlays (modals, pop-ups) dynamically.@wordpress/scripts or a custom bundler (webpack/vite)?"references/server-side-rendering.mdreferences/directives-quickref.mdreferences/debugging.mdGet started with chainctlchainctl skill install public/automattic/wp-interactivity-api:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/automattic/skills/wp-interactivity-api:latest
MIT
HARDENING.md
SKILL.md
references/debugging.md
references/directives-quickref.md
references/server-side-rendering.md