WP-CLI security

When to use this skill

Use this skill whenever code registers or implements a WP-CLI command:

• WP_CLI::add_command( 'my-plugin thing', ... ).
• Writing a command class method that reads $args / $assoc_args.
• Running destructive operations (delete, reset, import, purge) from the command line.
• Returning data or logging progress from a CLI routine.

WP-CLI runs as the system user, often as root on containers or with broad file-system permissions. It has no WordPress current user by default, so current_user_can() does not authorize CLI actions. Arguments are still untrusted input.

Related: see the capability-permission-checks skill for normal web-request authorization and the cron-background-job-security skill for scheduled jobs.

Core principles (and why they matter)