Cron & background job security

When to use this skill

Use this skill whenever code schedules or runs WordPress cron events:

• Calling wp_schedule_event() or wp_schedule_single_event().
• Writing a callback for a cron hook (add_action( 'my_plugin_daily_sync', ... )).
• Running jobs through wp-cron.php, including externally triggered real cron.
• Storing context (user ids, arguments) for a job to act on later.

Cron callbacks run with no current user. current_user_can() returns false for everything, and wp-cron.php is publicly reachable. Authorization must be captured at schedule time and re-verified inside the callback against stored context, not the absent current user.

Related: see the secrets-credentials-management skill for keeping keys out of cron URLs and the capability-permission-checks skill for normal request authorization.