skills.rest
tonnychiulab
tonnychiulabCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

wp-code-auditor

Analyze WordPress PHP code for SQL injection, XSS, and permission vulnerabilities.

1|Updated Feb 6, 2026
One-click install
npx skills add https://github.com/tonnychiulab/wp-security-architect --skill wp-code-auditor
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: wp-code-auditor
Source: https://github.com/tonnychiulab/wp-security-architect/tree/main/.agent/skills/wp-code-auditor
Command: npx skills add https://github.com/tonnychiulab/wp-security-architect --skill wp-code-auditor

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security engineers and code reviewers identify and remediate vulnerabilities in WordPress plugins and themes by performing static analysis (SAST) on PHP code. It targets common development flaws such as SQL Injection, XSS, and permission issues, ensuring code adheres to WordPress security guidelines.

Core Features & Use Cases

  • Static code analysis to detect insecure patterns, coding smells, and potential security flaws in plugins and themes.
  • Vulnerability targeting for SQL Injection, XSS, and permission-related weaknesses across WordPress PHP code.
  • Use Case: Ideal for security reviews of WordPress plugins/themes, onboarding developers to secure WordPress development, and recurring code audits.

Quick Start

Provide a set of PHP source files from a WordPress plugin or theme to the auditor and run the analysis to receive a structured vulnerability report.

Frequently Asked Questions about wp-code-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a static security audit on WordPress plugin PHP code?▼

To scan WordPress theme PHP files for vulnerabilities, submit the theme source files for static analysis. The auditor identifies security flaws like SQL Injection and XSS, returning a structured report that leverages WordPress security guidelines and recommends remediation steps.

What types of security vulnerabilities can static analysis find in WordPress plugins?▼

Static analysis identifies common WordPress development flaws, specifically targeting SQL Injection, Cross-Site Scripting (XSS), and permission-related weaknesses. It detects insecure patterns and coding smells to ensure your plugin code adheres to WordPress security guidelines.

Does WordPress code auditing work with PHPStan and PHP_CodeSniffer?▼

Yes, WordPress code auditing can optionally leverage tools like PHPStan, Psalm, and PHP_CodeSniffer to enforce coding standards. These tools complement the static analysis by helping validate that your PHP code meets security guidelines and best practices.

Can I use this for a recurring security review of WordPress themes and plugins?▼

Yes, this static analysis approach suits recurring security reviews of WordPress themes and plugins. It helps security engineers and onboarding developers identify insecure patterns and validate code against WordPress security guidelines during recurring audits.

What is the best way to check WordPress PHP code for permissions issues?▼

The best way to check WordPress PHP code for permissions issues is through static analysis targeting access control weaknesses. The auditor reviews your plugin and theme source files to detect permission-related flaws and recommends secure WordPress development practices.

Related Skills

martinholovskymartinholovsky
12

sota-php

Enforce PHP 8.3+ security, performance, and coding standards with PHPStan and Psalm.

Community
Advanced
weDevsOfficialweDevsOfficial
224

security-review

Analyze PHP and JavaScript code changes in WordPress plugins for security vulnerabilities.

Official
Advanced
morodomimorodomi
8

wordpress-quality

Run PHPStan, PHP_CodeSniffer, and PHPUnit checks on WordPress projects.

Community
Intermediate
adityaarsharmaadityaarsharma
2

orbit-wp-security

Detect security vulnerabilities in WordPress plugin PHP source code via static analysis.

Community
Advanced