Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+21 more

    WordPress Security Code Auditor

    1

    Expert Security Auditing for WordPress Modern WordPress security requires more than just pattern matching or basic linting.

    $27.99

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    WordPress Security Code Auditor

    WordPress Security Code Auditor

    Example session with this skill installed

    Audit our lead-capture mu-plugin (lead-capture.php, pasted, about 120 lines). It registers wp_ajax_nopriv_save_lead, which inserts $_POST['email'] into a custom table with $wpdb->query and string concatenation, and a [lead_thanks] shortcode that echoes $_GET['ref'] back to the page.

    • Read your context and instructions
    • Compiled the wordpress security code

    Mode: AUDIT. Exposure tier: E3 (unauthenticated AJAX and a public shortcode), +1 Impact applied.

    Entry points

    • wp_ajax_nopriv_save_lead reads $_POST['email']
    • [lead_thanks] reads $_GET['ref']

    Findings

    #FindingClassFile:LineCWEImpEffScore
    1Email concatenated into $wpdb->query4 SQLlead-capture.php:41CWE-895125.0
    2ref echoed unescaped2 Escapinglead-capture.php:88CWE-795125.0
    3No nonce on save_lead3 Noncelead-capture.php:33CWE-352333.0

    Line numbers are from the pasted file. #1 and #2 block launch.

    Patch for #1

    $email = isset( $_POST['email'] ) ? sanitize_email( wp_unslash( $_POST['email'] ) ) : '';
if ( ! is_email( $email ) ) { wp_send_json_error( 'invalid', 400 ); }
$wpdb->insert( $wpdb->prefix . 'leads', array( 'email' => $email ), array( '%s' ) );

    Patch for #2

    $ref = isset( $_GET['ref'] ) ? sanitize_text_field( wp_unslash( $_GET['ref'] ) ) : '';
return '<p>' . esc_html( $ref ) . '</p>';

    Next steps

    • Add check_ajax_referer( 'save_lead', 'nonce' ) and send the nonce from the form.
    • Add phpcs.xml.dist with WordPress.Security sniffs as a blocking CI step.
    • Say "harden" for full patches and the acceptance checklist.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Expert Security Auditing for WordPress

    Modern WordPress security requires more than just pattern matching or basic linting. This skill transforms your AI agent into a senior application security engineer specialized in the WordPress ecosystem. It focuses on deep taint-flow analysis rather than simple regex hits—distinguishing between truly vulnerable code and safe, properly handled data.

    Advanced Taint-Flow Analysis

    Unlike generic scanners, this tool understands context. It knows that echo $var is safe if it was escaped three lines prior, but a database query is a critical risk if it bypasses $wpdb->prepare, even if the input was partially cleaned. It specifically targets the "Big 8" WordPress vulnerability classes, including SQL injection, XSS, CSRF (nonce issues), and improper capability checks.

    Two Specialized Modes

    • AUDIT: Provides a comprehensive, scored findings table with Impact/Effort metrics and exploit sketches based on your specific exposure tier (E1-E3).
    • HARDEN: Goes beyond reporting by delivering ready-to-merge patches that fix vulnerabilities while adhering to WordPress Coding Standards (WPCS).

    Why It's Better Than Manual Prompting

    Prompting an AI to "find security bugs" often results in generic OWASP advice and false positives. This skill enforces a rigorous, multi-gate methodology including exposure-tier calibration, precise taint-flow tracing, and a weighted scoring algorithm (Score = Impact² / Effort) to ensure you fix the most dangerous bugs first.

    • Static analysis only: cannot interact with live databases.
    • Struggles with obfuscated or heavily minified JS.
    • Focused on code, not server-level WAF or firewall configs.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before any payment.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 4 months ago

    Permissions

    Read Files
    Listed4 months ago
    Updated12 days ago

    What's inside

    Frequently Asked Questions

    Unlike scanners that flag every instance of 'echo', this skill uses deep taint-flow analysis to trace data from the WP-API to the output, eliminating false positives and focusing on the 8 most critical WordPress vulnerability classes.

    The skill is designed to work with advanced LLM agents (like Claude 3.5 Sonnet or GPT-4o) that support file-system access or code interpretation, allowing it to ingest and analyze multi-file WordPress plugins or themes.

    You receive the specialized logic and methodology required to transform your AI agent into an auditor, including the 'AUDIT' and 'HARDEN' workflows, the vulnerability scoring algorithm, and a guide for integration.

    In 'HARDEN' mode, the skill generates code snippets that are not only secure but also formatted to comply with WordPress Coding Standards (WPCS), making them ready for immediate code review or merging.

    Yes, the skill is specifically engineered to handle the WordPress ecosystem, including internal functions like $wpdb methods, nonce verification, and capability checks (current_user_can).