WordPress Security Code Auditor

Expert Security Auditing for WordPress

Modern WordPress security requires more than just pattern matching or basic linting. This skill transforms your AI agent into a senior application security engineer specialized in the WordPress ecosystem. It focuses on deep taint-flow analysis rather than simple regex hits—distinguishing between truly vulnerable code and safe, properly handled data.

Advanced Taint-Flow Analysis

Unlike generic scanners, this tool understands context. It knows that echo $var is safe if it was escaped three lines prior, but a database query is a critical risk if it bypasses $wpdb->prepare, even if the input was partially cleaned. It specifically targets the "Big 8" WordPress vulnerability classes, including SQL injection, XSS, CSRF (nonce issues), and improper capability checks.

Two Specialized Modes

• AUDIT: Provides a comprehensive, scored findings table with Impact/Effort metrics and exploit sketches based on your specific exposure tier (E1-E3).
• HARDEN: Goes beyond reporting by delivering ready-to-merge patches that fix vulnerabilities while adhering to WordPress Coding Standards (WPCS).

Why It's Better Than Manual Prompting

Prompting an AI to "find security bugs" often results in generic OWASP advice and false positives. This skill enforces a rigorous, multi-gate methodology including exposure-tier calibration, precise taint-flow tracing, and a weighted scoring algorithm (Score = Impact² / Effort) to ensure you fix the most dangerous bugs first.