wp-settings-storage-audit
Installation
SKILL.md
WP Settings Storage Audit
Use this skill to audit the persistence contract for plugin settings and classic theme settings. It complements UI-specific skills: wp-admin-settings-api explains how to render/save a classic admin form, wp-plugin-options-storage chooses the storage primitive, and classic-theme-customizer covers Customizer UI.
The core question is: can another developer safely predict where each setting is stored, what shape it has, when it is loaded, how it is sanitized, and which code path reacts after it changes?
Verdicts
| Verdict | Meaning |
|---|---|
| Correct | Each setting has the right storage primitive, stable prefixed name, documented array shape, sanitize/validate/default path, intentional autoload, and safe read/write APIs. |
| Risky | The settings work but have weak schema, autoload bloat, tab wipe risk, unclear defaults, REST schema mismatch, or Customizer/plugin boundary issues. |
| Incorrect | The code stores durable state in the wrong primitive, trusts raw request data, bypasses nonce/capability checks, misuses unregistered options through options.php, stores plugin data in theme mods, or relies on deprecated behavior. |
Audit Workflow
1. Classify the setting
Pick the primitive by ownership and access pattern: