wp-interactivity-api — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited wp-interactivity-api (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the user mentions:
@wordpress/interactivity,data-wp-interactive, data-wp-on--*, data-wp-bind--*, data-wp-context,viewScriptModule / module-based view scripts,wp-project-triage).Search for:
data-wp-interactive@wordpress/interactivityviewScriptModuleDecide:
block.json view script module?If you’re creating a new interactive block (not just debugging), prefer the official scaffold template:
@wordpress/create-block-interactive-template (via @wordpress/create-block)Locate store definitions and confirm:
data-wp-on--*.Pre-render HTML on the server before outputting to ensure:
#### Enable server directive processing
For components using block.json, add supports.interactivity:
{
"supports": {
"interactivity": true
}
}For themes/plugins without block.json, use wp_interactivity_process_directives() to process directives.
#### Initialize state/context in PHP
Use wp_interactivity_state() to define initial global state:
wp_interactivity_state( 'myPlugin', array(
'items' => array( 'Apple', 'Banana', 'Cherry' ),
'hasItems' => true,
));For local context, use wp_interactivity_data_wp_context():
<?php
$context = array( 'isOpen' => false );
?>
<div <?php echo wp_interactivity_data_wp_context( $context ); ?>>
...
</div>#### Define derived state in PHP
When derived state affects initial HTML rendering, replicate the logic in PHP:
wp_interactivity_state( 'myPlugin', array(
'items' => array( 'Apple', 'Banana' ),
'hasItems' => function() {
$state = wp_interactivity_state();
return count( $state['items'] ) > 0;
}
));This ensures directives like data-wp-bind--hidden="!state.hasItems" render correctly on first load.
For detailed examples and patterns, see references/server-side-rendering.md.
When touching markup directives:
WordPress 6.9 changes:
--- separator (e.g., data-wp-on--click---plugin-a="..." and data-wp-on--click---plugin-b="...").AsyncAction<ReturnType> and TypeYield<T> help with async action typing.For quick directive reminders, see references/directives-quickref.md.
Verify the repo supports the required module build path:
@wordpress/scripts, prefer its conventions.If “nothing happens” on interaction:
viewScriptModule is enqueued/loaded,data-wp-interactive,See references/debugging.md.
wp-project-triage indicates signals.usesInteractivityApi: true after your change (if applicable).data-wp-interactive.wp_interactivity_state() with closures.supports.interactivity not set in block.json (for blocks).wp_interactivity_process_directives() not called (for themes/plugins).state.hasItems missing on server, causing hidden attribute to be absent.getServerState() and getServerContext() now reset between page transitions—ensure your code doesn't assume stale values persist.attachTo for rendering overlays (modals, pop-ups) dynamically.@wordpress/scripts or a custom bundler (webpack/vite)?"references/server-side-rendering.mdreferences/directives-quickref.mdreferences/debugging.md~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.