Wp Security Review
WordPress security code review for Codex. Use when reviewing themes, plugins, or custom WordPress code for XSS, SQL injection, CSRF, auth gaps, unsafe uploads, dangerous functions, or insecure REST and AJAX handlers.
Install
$ agentstack add skill-jorgerosal-wordpress-skills-wp-security-review ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-jorgerosal-wordpress-skills-wp-security-review) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Codex WordPress Security Review
Purpose
Use this skill when Codex should audit WordPress code for exploitable security issues and produce findings with file references, severity, and direct remediation guidance.
Focus Areas
- XSS from missing output escaping
- SQL injection from unprepared database access
- CSRF gaps in forms, AJAX handlers, and state-changing flows
- Missing capability checks and authorization mistakes
- Unsafe file uploads and dangerous PHP functions
- REST and AJAX endpoints with weak permission controls
Workflow
- Identify public-facing, admin-only, AJAX, REST, and upload surfaces.
- Check critical exploit paths first: SQL injection, public XSS, missing nonces on state-changing actions, and unsafe uploads.
- Validate WordPress-specific security patterns such as nonce checks, capability checks, sanitization, and late escaping.
- Load only the relevant reference docs from the shared security references.
- Report findings with severity, file references, exploit impact, and a safe fix pattern.
Reference Files
Load only the references you need from:
../../claude-skills/wp-security-review/references/vulnerability-patterns.md../../claude-skills/wp-security-review/references/nonce-csrf-guide.md../../claude-skills/wp-security-review/references/auth-patterns.md../../claude-skills/wp-security-review/references/escaping-guide.md../../claude-skills/wp-security-review/references/sanitization-guide.md
Output
- Use
CRITICAL,WARNING, andINFO - Include file references and affected surface area
- Name the WordPress security control that is missing or misused
- Recommend a secure replacement pattern
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: jorgerosal
- Source: jorgerosal/wordpress-skills
- License: MIT
- Homepage: https://jorgerosal.github.io/wordpress-skills/
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.