security-analysis

Analyze WordPress PHP codebases against OWASP Top 10 vulnerabilities.

27|1|Updated Feb 16, 2026

Search Tags:#code review #security #vulnerability #owasp #audit #wordpress

Ready to run

npx skills add https://github.com/dr-robert-li/cowork-wordpress-expert --skill security-analysis-dr-robert-li

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-analysis
Source: https://github.com/dr-robert-li/cowork-wordpress-expert/tree/main/skills/security-analysis
Command: npx skills add https://github.com/dr-robert-li/cowork-wordpress-expert --skill security-analysis-dr-robert-li

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps identify and mitigate security vulnerabilities within a WordPress codebase, protecting your site from common attacks and data breaches.

Core Features & Use Cases

OWASP Top 10 Audit: Evaluates code against the latest OWASP Top 10 security risks.
WordPress-Specific Checks: Identifies vulnerabilities common in WordPress plugins and themes.
Use Case: Before deploying a new custom plugin, use this Skill to perform a thorough security audit to ensure it adheres to best practices and is free from common exploits.

Quick Start

Run a security analysis on the WordPress codebase located at /var/www/html.

Frequently Asked Questions about security-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit a WordPress plugin for security vulnerabilities before deployment?▼

To audit a WordPress plugin for security vulnerabilities, run static analysis on the PHP files to check input validation, output escaping, and authorization. This process evaluates the code against the OWASP Top 10 and WordPress-specific vulnerability patterns to prevent common exploits.

What does an OWASP Top 10 security audit cover in a WordPress codebase?▼

An OWASP Top 10 security audit covers the evaluation of a WordPress codebase for SQL injection, data exposure, authentication, and file security. It scopes input validation and output escaping while checking WordPress core integrity to identify malicious code and common plugin vulnerabilities.

Can I check WordPress core integrity and detect malicious PHP code automatically?▼

Yes, you can check WordPress core integrity and detect malicious code by performing static analysis of PHP files. This security auditing approach identifies malicious code patterns and verifies the core integrity of your WordPress site to protect against data breaches.

Does this security analysis detect SQL injection and data exposure in custom themes?▼

Yes, this security analysis detects SQL injection and data exposure in custom themes by evaluating PHP files against WordPress-specific vulnerability patterns. It assesses input validation and output escaping to ensure the theme adheres to best practices and is free from common exploits.

What's the best way to investigate a security incident in a WordPress codebase?▼

The best way to investigate a WordPress security incident is to run static analysis on the PHP codebase to identify malicious code and vulnerability patterns. This incident investigation checks WordPress core integrity, authentication, and authorization to uncover potential data breaches.