wp-plugin-audit

Solid

Use when auditing a WordPress plugin for security issues, code inconsistencies, or quality gaps — fans out parallel checks across four dimensions: A (version/metadata sync), B (naming/prefix/i18n), C (docs vs code), D (code conventions/security), verifies every finding with file:line references before reporting, and routes confirmed issues to the correct fix skill. Security patterns checked: XSS (missing esc_html/esc_attr), SQL injection (raw $wpdb), CSRF (missing nonce), missing capability checks, file upload validation, object unserialize, open redirect, path traversal, REST auth hardening. Triggers: "audit this plugin", "find inconsistencies in my plugin", "security review", "check my plugin for XSS", "is my escaping correct", "find missing nonces", "check capabilities in my plugin", "audit readme.txt", "find security issues", "plugin quality sweep", "are there SQL injection risks", "review my plugin before submission", "missing esc_html()", "raw wpdb query without prepare()", "missing current_user_can()",

Data & Documents 26 stars 3 forks Updated 1 weeks ago MIT

Install

View on GitHub

Quality Score: 80/100

Stars 20%
48
Recency 20%
90
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
80
License 10%
100
Description 5%
100

Skill Content

# WordPress Plugin Consistency Audit Read-only audit that surfaces inconsistencies across a WP plugin's code, config, and docs. Optimised for **recall with low false-positive rate**: every candidate is verified against the actual code before it reaches the report. ## When to use - "Audit the plugin", "find inconsistencies", "consistency/quality sweep". - Before a release, or after a large refactor, to catch drift. **Not for:** PHPStan type checking or baseline generation — use `wp-phpstan` (official). WP.org pre-submission review (17 rejection patterns) — use `wp-org-submission` which has that checklist. ## Method ### 1. Fan out — 4 independent dimensions (parallel agents) Dispatch one read-only agent per dimension (`Explore` type, `model: haiku`), in a single message so they run concurrently. Each returns findings with `file:line`, the inconsistent value, and the expected/canonical form. > **Model note:** Dimension agents are pure grep/read with no synthesis — `haiku` is faster and cheaper. The main thread (whatever model the user has active) does all verification and reporting. - **A — Version & metadata.** Cross-reference every version/metadata source: plugin header (`Version`, `Requires at least`, `Requires PHP`, `Tested up to`, `Text Domain`), the version constant, `readme.txt` (`Stable tag` + Changelog + Upgrade Notice), `composer.json`, the `.pot` `Project-Id-Version`, and the schema/DB version. Flag every mismatch; note fields that are *intentionally* indepen...

Details

Author
mralaminahamed
Repository
mralaminahamed/wp-dev-skills
Created
1 months ago
Last Updated
1 weeks ago
Language
PHP
License
MIT

Integrates with

Similar Skills

Semantically similar based on skill content — not just same category

Data & Documents Listed

wordpress-architect-review

Use to produce a structured senior-architect code review of a WordPress plugin or theme - file-by-file audit covering security, performance, architecture, correctness, WordPress standards, accessibility, i18n, and missing infrastructure, with a 1-10 scorecard, severity-tagged findings (SEVERE/MODERATE/MINOR), file:line citations, quoted offending code, top-5 prioritized fixes, and an optional 3-phase refactor roadmap. Use whenever the user asks to "review my WordPress plugin", "audit a WP theme", "code review this plugin", "check my plugin for security issues", "is this plugin secure", "rate my WordPress plugin", "theme review before submission", "WPCS compliance check", "WordPress security audit", "architect review", or "find security holes in this plugin" - or points at a directory containing a plugin or theme to evaluate. Scope is locked to WordPress plugin/theme code review only; refuses tutorials, recommendations, hosting advice, or non-code questions. For advisory/strategy audits use wordpress-consultan

2 Updated 2 days ago
chrismccoy
Code & Development Listed

auditsmith

Use when auditing, reviewing, or assessing an application's codebase — including narrower phrasings like 'review my code', 'is this secure', 'is this production ready', 'why is this slow', 'check my error handling', 'is my LLM integration safe', 'find issues in this repo', or 'what am I missing before launch'. Covers ten areas — UX behavior, code quality, UI, security, LLM/AI usage, performance, testing, dependencies, observability, API contracts. Detects auth/authz gaps, IDOR, injection, secrets, SSRF, prompt injection, race conditions, missing error handling, empty states, N+1 queries, bundle bloat, memory leaks, flaky tests, CVEs, idempotency gaps, missing logging/alerting. Contexts — pre-launch, handover, client delivery, code review, refactor planning. Outputs findings with file:line evidence, severity ranking, and CI/lint rules to prevent regression. Stacks — React, TypeScript, Node, Python, Go, Cloudflare Workers.

1 Updated 4 days ago
opefyre
Web & Frontend Listed

harness-audit

Audits this bigin-skills plugin against current official Claude Code docs (skills, hooks, sub-agents, plugins, memory) — findings report only, never auto-fixes. Triggers: 'audit the harness', 'recheck against best practices', 'is this still current'.

0 Updated 2 days ago
tammai