wp-devkit-security-review
Review or remediate reachable WordPress security defects: missing capability or ownership checks, XSS, SQL injection, CSRF, SSRF, unsafe uploads, secrets, dependency risk, multisite isolation. Use for plugin/theme/REST/AJAX audits and exploit-path triage; route design belongs to the REST skill.
Pinned to revision acbdbe0c60f7, so it is the text this page describes rather than whatever the author pushed since.
Files
- skills/wp-devkit-security-review/SKILL.md
- skills/wp-devkit-security-review/agents/openai.yaml
- skills/wp-devkit-security-review/references/abuse-multisite-concurrency.md
- skills/wp-devkit-security-review/references/access-control-and-csrf.md
- skills/wp-devkit-security-review/references/dependency-supply-chain.md
- skills/wp-devkit-security-review/references/engineering-contract.md
- skills/wp-devkit-security-review/references/files-network-and-execution.md
- skills/wp-devkit-security-review/references/input-output-and-sql.md
- skills/wp-devkit-security-review/references/runtime-hardening.md
- skills/wp-devkit-security-review/references/secrets-and-integrity.md
- skills/wp-devkit-security-review/references/security-review-workbook.md
Every link opens the file at its source, pinned to the revision this page describes.