·
Last changedVersion:
This version passed the hardening gate. Hardening applied 8 targeted changes and preserved all other text. Classified findings before hardening: 1. Classified findings closed: 0. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 7. Review findings remaining: 0.
1
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Prompt Injection | Third-party content as instructions | Low | Open |
1 finding
Use this skill when the user mentions:
@wordpress/interactivity,data-wp-interactive, data-wp-on--*, data-wp-bind--*, data-wp-context,viewScriptModule / module-based view scripts,wp-project-triage).wp-project-triage is a separate skill; review its output on its own before relying on it.Search for:
data-wp-interactive@wordpress/interactivityviewScriptModuleDecide:
block.json view script module?If you’re creating a new interactive block (not just debugging), prefer the official scaffold template:
@wordpress/create-block-interactive-template (via @wordpress/create-block)Before scaffolding, get the user's confirmation, agree on a specific released version rather than the latest one, confirm the exact package name under the official WordPress scope, and review the generated package manifest, lockfile, and scripts before installing dependencies.
Locate store definitions and confirm:
data-wp-on--*.Pre-render HTML on the server before outputting to ensure:
For components using block.json, add supports.interactivity:
For themes/plugins without block.json, use wp_interactivity_process_directives() to process directives.
Use wp_interactivity_state() to define initial global state:
All state and context is printed into the public page HTML and may be stored by page caches. Keep it to public, non-sensitive values, and keep secrets, API keys, privileged nonces, and other users' personal data on the server. Gate per-user values behind capability checks and account for caching on personalized pages.
For local context, use wp_interactivity_data_wp_context():
When derived state affects initial HTML rendering, replicate the logic in PHP:
This ensures directives like data-wp-bind--hidden="!state.hasItems" render correctly on first load.
Keep derived-state closures pure, read-only functions of state and context: they should only read and return values, leaving database writes, remote calls, and printed output out of them. Let rendered values flow through directive processing or WordPress escaping functions.
For detailed examples and patterns, see references/server-side-rendering.md.
When touching markup directives:
WordPress 6.9 changes:
data-wp-ignore is deprecated and will be removed in future versions. It broke context inheritance and caused issues with client-side navigation. Avoid using it.--- separator (e.g., data-wp-on--click---plugin-a="..." and data-wp-on--click---plugin-b="...").AsyncAction<ReturnType> and TypeYield<T> help with async action typing.For quick directive reminders, see references/directives-quickref.md.
Verify the repo supports the required module build path:
@wordpress/scripts, prefer its conventions.If “nothing happens” on interaction:
viewScriptModule is enqueued/loaded,data-wp-interactive,See references/debugging.md.
wp-project-triage indicates signals.usesInteractivityApi: true after your change (if applicable).data-wp-interactive.wp_interactivity_state() with closures.supports.interactivity not set in block.json (for blocks).wp_interactivity_process_directives() not called (for themes/plugins).state.hasItems missing on server, causing hidden attribute to be absent.getServerState() and getServerContext() now reset between page transitions—ensure your code doesn't assume stale values persist.attachTo for rendering overlays (modals, pop-ups) dynamically.@wordpress/scripts or a custom bundler (webpack/vite)?"references/server-side-rendering.mdreferences/directives-quickref.mdreferences/debugging.mdGet started with chainctlchainctl skill install public/wordpress/wp-interactivity-api:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/wordpress/skills/wp-interactivity-api:latest
MIT
HARDENING.md
SKILL.md
references/debugging.md
references/directives-quickref.md
references/server-side-rendering.md