From agent-skills
Performs a systematic, evidence-based code audit of WordPress projects — specifically custom must-use (mu) plugins and custom themes — covering security, performance, readability, and UX. Use this skill whenever the user asks for a code audit, code review, security review, performance review, pre-launch review, or general quality pass on a WordPress codebase, or when they mention reviewing/auditing a WordPress plugin, theme, or mu-plugin. Trigger even when the phrasing is loose ("can you look over this theme", "give this plugin a once-over", "is this production-ready") as long as WordPress is in the picture. Default deliverable is a written report — do not modify project files unless the user explicitly asks for fixes.
How this skill is triggered — by the user, by Claude, or both
Slash command
/agent-skills:wordpress-auditThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Systematic audit of a WordPress codebase focused on a custom mu-plugin and a custom theme. Produces a severity-ranked report with file:line evidence and recommended fixes.
Systematic audit of a WordPress codebase focused on a custom mu-plugin and a custom theme. Produces a severity-ranked report with file:line evidence and recommended fixes.
$wpdb->prepare, wp_enqueue_*, capability checks, text domains) rather than generic PHP advice.If a user asks for a "quick look" or "opinion" rather than a full audit, offer a lighter-weight walkthrough and confirm before running the whole methodology.
The audit runs in three phases: Recon → Analysis → Report. Do them in order. Don't skip recon to jump straight to findings — without a map of the codebase, the analysis will miss whole categories of issues.
Goal: build a mental model of the codebase and inventory the attack surface and hot spots. The analysis phase is only as good as the recon.
Locate the project root. WordPress projects usually have wp-content/mu-plugins/ and wp-content/themes/<theme-name>/. If the user points at a subfolder, confirm which directories are in scope before proceeding.
Walk the codebase and catalog:
functions.php, any bootstrap/loader files in mu-plugins/ (remember: WordPress does not auto-load mu-plugins from subdirectories — a top-level loader file is required).add_action() and add_filter() call — note the hook name, callback, priority, and accepted args.wp_ajax_* and wp_ajax_nopriv_* action. nopriv handlers are public; flag them for extra scrutiny.register_rest_route() call. Note the permission_callback — missing or __return_true is a serious finding.add_shortcode(), register_block_type().$wpdb usage. Raw SQL. dbDelta() calls. Custom table creation.$_GET / $_POST / $_REQUEST / $_COOKIE / $_FILES / php://input, settings pages, Customizer controls.echo, print, template partials, returned HTML strings.wp_remote_*, file_get_contents on URLs, file reads/writes, shell_exec/exec/system (any of these last three warrant immediate flagging).composer.json, vendored libraries, bundled JS packages.Keep this inventory in a scratchpad. It becomes the input for Phase 2 and the appendix of the report.
Goal: run each finding category against the inventory from Phase 1. Work through all four checklists — do not stop after security just because something looks bad there.
Read the reference files as you go. They are the authoritative checks:
references/security-checklist.md — nonces, capability checks, sanitization, escaping, SQL injection, CSRF, file upload, auth on REST/AJAX, secrets, redirects, serialization, SSRFreferences/performance-checklist.md — N+1 queries, autoloaded options, caching, transients, asset loading, meta queries, remote request timeoutsreferences/readability-checklist.md — WPCS, PHPDoc, naming, file structure, separation of concerns, dead codereferences/ux-checklist.md — accessibility, i18n/l10n, admin notices, mobile responsiveness, error statesFor each potential issue, before recording it, verify three things:
Assign each finding a severity. Be strict — inflation makes the report less useful.
| Severity | Meaning | Examples |
|---|---|---|
| Critical | Exploitable vulnerability, data loss risk, or site-breaking bug. Fix before next deploy. | Unauthenticated privilege escalation, SQL injection, RCE, unescaped user input rendered to admins, permission_callback missing on destructive REST route |
| High | Serious bug or vulnerability requiring authentication/specific conditions, or a performance issue that will degrade production under normal load. | Authenticated XSS, missing nonce on state-changing action, N+1 query on a public page, non-autoloaded large option accessed on every request becoming autoloaded |
| Medium | Real problem with a clear impact but limited blast radius. | Missing capability check where a nonce still gates access, missing transient on an expensive external call, inaccessible form control, hardcoded English strings |
| Low | Quality and maintainability issues, minor UX gaps, style inconsistencies. | WPCS violations, missing PHPDoc, inconsistent naming, dead code, minor contrast issues |
| Info | Observations worth mentioning but not defects. | Deprecated-but-still-working API, opportunity for refactor, version mismatch |
When a finding sits between two severities, bump it up, not down.
Use the exact structure in references/report-template.md. Key rules:
file.php:L123), impact, evidence (short code excerpt, 3–10 lines), recommendation.Write the report to a single markdown file in the project root (or wherever the user specifies) as AUDIT-<YYYY-MM-DD>.md. Don't scatter findings into separate files; a single document is easier to triage.
rg -n "\\\$_(GET|POST|REQUEST|COOKIE)" --type php, rg -n "wp_ajax_" --type php, rg -n "register_rest_route" --type php, rg -n "\\\$wpdb->" --type php, and rg -n "\beval\b|shell_exec|passthru|system\(" --type php get you 80% of the attack surface in under a minute.For a codebase too big to hold in working memory at once:
Before kicking off a full audit, confirm with the user:
AUDIT-<date>.md in the project root)?Then proceed through the three phases.
Creates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.
npx claudepluginhub happyprime/agent-skills --plugin agent-skills