Codex Skills: cómo crear workflows reutilizables con SKILL.md

---
name: code-review
description: Review code changes for correctness, regressions, security issues and missing tests. Use when the user asks to review code, a diff, branch or pull request.
---

# Code Review

Review the current changes.

Prioritize:

1. correctness bugs
2. regressions
3. security vulnerabilities
4. data-loss risks
5. missing authorization
6. missing regression tests

For every finding provide:

- severity
- file
- line
- impact
- recommended fix

Do not report subjective style preferences.

my-skill/
├── SKILL.md
│
├── agents/
│   └── openai.yaml
│
├── scripts/
│   ├── validate.py
│   └── collect-data.sh
│
├── references/
│   ├── checklist.md
│   └── architecture.md
│
└── assets/
    ├── template.md
    └── report-template.html

$skill-creator

$skill-creator

Crea una Skill
para revisar plugins WordPress.

Debe comprobar:

- nonces
- capabilities
- sanitización
- escaping
- SQL
- AJAX
- REST API
- WooCommerce
- PHP 8.2+

La Skill debe entregar
hallazgos por severidad,
archivo y línea.

---
name: wordpress-security-review
description: Review WordPress plugins and themes for security vulnerabilities. Use when asked to audit WordPress PHP, AJAX, REST routes, database queries, authentication, authorization or WooCommerce integrations.
---

# WordPress Security Review

Review the requested WordPress code.

Check:

1. input validation
2. sanitization
3. output escaping
4. nonces
5. capabilities
6. SQL queries
7. REST permission callbacks
8. AJAX authorization
9. file operations
10. exposed secrets

Return only actionable findings.

For every finding include:

- severity
- file
- line
- vulnerability
- impact
- recommended fix

---
name: wordpress-security-review
description: Review WordPress plugins and themes for security vulnerabilities. Use for WordPress security audits involving PHP, AJAX, REST API, database access, authentication or authorization.
---

~/.agents/skills/
└── security-review/
    └── SKILL.md

mi-proyecto/
├── AGENTS.md
│
├── .agents/
│   └── skills/
│       ├── release/
│       │   └── SKILL.md
│       │
│       └── security-review/
│           └── SKILL.md
│
├── src/
└── tests/

repo/
├── .agents/
│   └── skills/
│       └── general-review/
│           └── SKILL.md
│
└── services/
    └── payments/
        ├── .agents/
        │   └── skills/
        │       └── payment-review/
        │           └── SKILL.md
        │
        └── src/

# Mejor

wordpress-security-review

php-security-review

api-security-review

/skills

$wordpress-security-review

Revisa los cambios actuales.

Audita este plugin WordPress
en busca de vulnerabilidades
de seguridad.

interface:
  display_name: "WordPress Security Review"
  short_description: "Audit WordPress code for security vulnerabilities"
  icon_small: "./assets/icon.svg"
  icon_large: "./assets/logo.png"
  brand_color: "#3B82F6"
  default_prompt: "Review the selected WordPress code."

policy:
  allow_implicit_invocation: true

policy:
  allow_implicit_invocation: false

$nombre-skill

release-check/
├── SKILL.md
│
└── scripts/
    └── validate_release.py

---
name: release-check
description: Validate a project before release. Use when preparing, validating or reviewing a release.
---

# Release Check

1. Inspect repository status.
2. Read the current version.
3. Run the release validation script:

   `python scripts/validate_release.py`

4. Run the project test suite.
5. Run the build.
6. Review the final diff.
7. Report blockers before publishing.

Do not publish or push anything unless explicitly requested.

wordpress-review/
├── SKILL.md
│
└── references/
    ├── security.md
    ├── ajax.md
    ├── rest-api.md
    └── woocommerce.md

# WordPress Review

First determine the task type.

For AJAX handlers:
read `references/ajax.md`.

For REST API routes:
read `references/rest-api.md`.

For WooCommerce integrations:
read `references/woocommerce.md`.

For security audits:
read `references/security.md`.

Do not load unrelated references.

release-notes/
├── SKILL.md
│
└── assets/
    └── release-template.md

dependencies:
  tools:
    - type: "mcp"
      value: "documentation"
      description: "Documentation MCP server"
      transport: "streamable_http"
      url: "https://example.com/mcp"

~/.codex/config.toml

[[skills.config]]
path = "/path/to/skill/SKILL.md"
enabled = false

$skill-installer linear

---
name: root-cause-debug
description: Debug reproducible software failures by finding the root cause before editing code. Use when investigating bugs, regressions, failing tests, crashes or unexpected behavior.
---

# Root Cause Debugging

Do not modify code immediately.

Follow this workflow:

1. reproduce the failure
2. identify the smallest failing path
3. inspect relevant logs and errors
4. identify the root cause
5. explain the cause
6. create or identify a regression test
7. implement the smallest safe fix
8. run relevant tests
9. review the final diff

Avoid speculative refactors.

At the end report:

- root cause
- files changed
- verification
- remaining risks

---
name: wordpress-security-review
description: Audit WordPress plugins and themes for security vulnerabilities. Use for security reviews involving PHP, AJAX, REST routes, authentication, authorization, database queries, file uploads or WooCommerce integrations.
---

# WordPress Security Review

Review only security-relevant behavior.

Check:

## Input

- validate external input
- sanitize values before storage or use

## Output

- use context-appropriate escaping

## Authorization

- check capabilities where required
- do not treat nonces as authorization

## CSRF

- verify nonces for state-changing requests

## Database

- use `$wpdb->prepare()` for dynamic SQL

## AJAX

- verify nonce
- verify authorization
- sanitize request values

## REST API

- review `permission_callback`
- verify public routes are intentionally public

## Files

- validate uploads
- prevent arbitrary file access

## Secrets

- do not expose keys or credentials

Return findings ordered by severity.

For each finding provide:

- severity
- file
- line
- vulnerable behavior
- realistic impact
- recommended fix

---
name: code-review
description: Review code changes, branches, diffs and pull requests for correctness, regressions, security issues and missing tests.
---

# Code Review

Review the changed behavior.

Prioritize:

1. correctness
2. regressions
3. security
4. data loss
5. concurrency issues
6. backwards compatibility
7. missing tests

Ignore:

- formatting already handled by tooling
- subjective naming preferences
- unrelated pre-existing issues

Each finding must include:

- priority
- file
- line
- explanation
- recommended correction

If no actionable findings exist,
say so explicitly.

---
name: release-check
description: Prepare and validate a software release. Use before publishing, tagging, packaging or deploying a new version.
---

# Release Check

Before publishing:

1. inspect Git status
2. confirm target version
3. check changelog
4. run tests
5. run lint
6. run typecheck if available
7. run production build
8. inspect generated artifacts
9. review final diff
10. report blockers

Do not:

- push
- publish
- deploy
- create tags

unless explicitly requested.

---
name: docs-sync
description: Update project documentation to match recent code changes. Use when APIs, configuration, installation steps, commands or user-facing behavior have changed.
---

# Documentation Sync

1. inspect the current diff
2. identify user-visible behavior changes
3. find affected documentation
4. update only impacted sections
5. preserve existing documentation style
6. verify code examples against the implementation
7. report documentation that remains uncertain

Do not invent undocumented behavior.

wordpress-release/
├── SKILL.md
│
├── scripts/
│   ├── php_syntax_check.py
│   └── package_plugin.py
│
├── references/
│   ├── wordpress-security.md
│   ├── woocommerce.md
│   └── release-checklist.md
│
├── assets/
│   └── changelog-template.md
│
└── agents/
    └── openai.yaml

DEBERÍA ACTIVARSE

"Audita la seguridad
de este plugin WordPress."


DEBERÍA ACTIVARSE

"Revisa los handlers AJAX
en busca de vulnerabilidades."


PROBABLEMENTE NO

"Corrige el CSS
responsive de este plugin."


NO DEBERÍA ACTIVARSE

"Escribe una descripción SEO
para mi plugin."

.agents/skills/
├── backend-code-review/
├── frontend-accessibility/
├── security-review/
├── database-migration/
├── release-check/
├── incident-debug/
└── docs-sync/