wp-plugin-audit
SolidUse when auditing a WordPress plugin for security issues, code inconsistencies, or quality gaps — fans out parallel checks across four dimensions: A (version/metadata sync), B (naming/prefix/i18n), C (docs vs code), D (code conventions/security), verifies every finding with file:line references before reporting, and routes confirmed issues to the correct fix skill. Security patterns checked: XSS (missing esc_html/esc_attr), SQL injection (raw $wpdb), CSRF (missing nonce), missing capability checks, file upload validation, object unserialize, open redirect, path traversal, REST auth hardening. Triggers: "audit this plugin", "find inconsistencies in my plugin", "security review", "check my plugin for XSS", "is my escaping correct", "find missing nonces", "check capabilities in my plugin", "audit readme.txt", "find security issues", "plugin quality sweep", "are there SQL injection risks", "review my plugin before submission", "missing esc_html()", "raw wpdb query without prepare()", "missing current_user_can()",
Install
Quality Score: 80/100
Skill Content
Details
- Author
- mralaminahamed
- Repository
- mralaminahamed/wp-dev-skills
- Created
- 1 months ago
- Last Updated
- 1 weeks ago
- Language
- PHP
- License
- MIT
Integrates with
Similar Skills
Semantically similar based on skill content — not just same category
wordpress-architect-review
Use to produce a structured senior-architect code review of a WordPress plugin or theme - file-by-file audit covering security, performance, architecture, correctness, WordPress standards, accessibility, i18n, and missing infrastructure, with a 1-10 scorecard, severity-tagged findings (SEVERE/MODERATE/MINOR), file:line citations, quoted offending code, top-5 prioritized fixes, and an optional 3-phase refactor roadmap. Use whenever the user asks to "review my WordPress plugin", "audit a WP theme", "code review this plugin", "check my plugin for security issues", "is this plugin secure", "rate my WordPress plugin", "theme review before submission", "WPCS compliance check", "WordPress security audit", "architect review", or "find security holes in this plugin" - or points at a directory containing a plugin or theme to evaluate. Scope is locked to WordPress plugin/theme code review only; refuses tutorials, recommendations, hosting advice, or non-code questions. For advisory/strategy audits use wordpress-consultan
auditsmith
Use when auditing, reviewing, or assessing an application's codebase — including narrower phrasings like 'review my code', 'is this secure', 'is this production ready', 'why is this slow', 'check my error handling', 'is my LLM integration safe', 'find issues in this repo', or 'what am I missing before launch'. Covers ten areas — UX behavior, code quality, UI, security, LLM/AI usage, performance, testing, dependencies, observability, API contracts. Detects auth/authz gaps, IDOR, injection, secrets, SSRF, prompt injection, race conditions, missing error handling, empty states, N+1 queries, bundle bloat, memory leaks, flaky tests, CVEs, idempotency gaps, missing logging/alerting. Contexts — pre-launch, handover, client delivery, code review, refactor planning. Outputs findings with file:line evidence, severity ranking, and CI/lint rules to prevent regression. Stacks — React, TypeScript, Node, Python, Go, Cloudflare Workers.
harness-audit
Audits this bigin-skills plugin against current official Claude Code docs (skills, hooks, sub-agents, plugins, memory) — findings report only, never auto-fixes. Triggers: 'audit the harness', 'recheck against best practices', 'is this still current'.