skills.rest
Lonsdale201
Lonsdale201COMMUNITY
Explore all skills by this author →
WebsiteGitHub

wp-security-deep

Detect advanced PHP security issues in WordPress plugins and themes.

21|1|Updated Apr 29, 2026
Search Tags:#security#audit#wordpress#csrf#ssrf#zip-slip#unserialize
One-click install
npx skills add https://github.com/Lonsdale201/wp-agent-skills --skill wp-security-deep
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: wp-security-deep
Source: https://github.com/Lonsdale201/wp-agent-skills/tree/main/wordpress/wp-security-deep
Command: npx skills add https://github.com/Lonsdale201/wp-agent-skills --skill wp-security-deep

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Deep security audit for WordPress plugin/theme PHP code, covering issues beyond the basic sanitize/escape/nonce checklist — including PHP object injection (unserialize), SSRF in remote requests, CSRF on state-changing GET handlers, mass assignment via $_POST loops, insecure file include / template injection, mail header injection, ZipSlip in archive extraction, type juggling in auth comparisons, and TOCTOU race patterns in option/meta locks. Use after or alongside wp-security-audit when reviewing complex plugins, REST APIs, integrations that fetch remote URLs, file processors, or any code that handles uploads, archives, or self-rolled auth tokens.

Core Features & Use Cases

  • Detect advanced PHP security issues beyond basic checks in WordPress plugins and themes.
  • Identify critical flaws such as object injection, SSRF, CSRF on GET handlers, mass assignment, insecure file inclusion, mail header injection, ZipSlip, and TOCTOU patterns.
  • Provide actionable remediation guidance and integration with wp-security-audit for layered defense.

Quick Start

Run a deep PHP security review on a WordPress plugin or theme using the checks described.

Frequently Asked Questions about wp-security-deep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a WordPress plugin for PHP object injection and unserialize vulnerabilities?▼

To audit WordPress plugins for PHP object injection and unserialize vulnerabilities, run a deep security review targeting complex codebases to identify unsafe deserialization patterns and receive specific remediation guidance.

What security checks are needed for WordPress plugins handling remote requests and file uploads?▼

Security checks for WordPress plugins handling remote requests and uploads must detect SSRF, ZipSlip in archive extraction, and insecure file inclusion, providing actionable remediation for layered defense across PHP versions.

Can I detect CSRF on state-changing GET handlers in WordPress themes?▼

Yes, you can detect CSRF on state-changing GET handlers in WordPress themes by applying deep PHP security checks that identify missing nonce verifications on sensitive operations.

How do I check WordPress REST APIs for type juggling and TOCTOU race conditions?▼

To check WordPress REST APIs for type juggling and TOCTOU race conditions, use deep security audits that analyze authentication comparisons and option/meta lock patterns for time-of-check-to-time-of-use flaws.

Does this deep security audit replace basic WordPress sanitize and escape checks?▼

This deep security audit does not replace basic WordPress sanitize and escape checks; it complements them by identifying advanced flaws like mass assignment via $_POST loops and mail header injection.

Related Skills

Explore More Software Engineering Skills→
shiaho777shiaho777
5.5k

wordpress-app

Scaffold WordPress themes, plugins, and blocks for on-device PHP 8.x runtimes.

Community
Advanced
biwakonbubiwakonbu

memory-audit

Audit Claude project memory configurations and generate an actionable report.

Community
Basic
jorgerosaljorgerosal
69

wp-security-review

Detect XSS, SQL injection, CSRF, and authorization gaps in WordPress code.

Community
Advanced
adityaarsharmaadityaarsharma
2

orbit-wp-security

Detect security vulnerabilities in WordPress plugin PHP source code via static analysis.

Community
Advanced