Use when auditing a WordPress plugin for security issues, code inconsistencies, or quality gaps — fans out parallel checks across four dimensions: A (version/metadata sync), B (naming/prefix/i18n), C (docs vs code), D (code conventions/security), verifies every finding with file:line references before reporting, and routes confirmed issues to the correct fix skill. Security patterns checked: XSS (missing esc_html/esc_attr), SQL injection (raw $wpdb), CSRF (missing nonce), missing capability checks, file upload validation, object unserialize, open redirect, path traversal, REST auth hardening. Triggers: \"audit this plugin\", \"find inconsistencies in my plugin\", \"security review\", \"check my plugin for XSS\", \"is my escaping correct\", \"find missing nonces\", \"check capabilities in my plugin\", \"audit readme.txt\", \"find security issues\", \"plugin quality sweep\", \"are there SQL injection risks\", \"review my plugin before submission\", \"missing esc_html()\", \"raw wpdb query without prepare()\", \"missing current_user_can()\", \"unprotected AJAX handler\", \"plugin prefix inconsistency\", \"version out of sync\", \"i18n audit\", \"missing translator comment\", \"file upload not validated\", \"open redirect risk\". Not for: PHPStan type analysis — use wp-phpstan; WP.org pre-submission checklist — use wp-org-submission.
How to install wp-plugin-audit?
mralaminahamed/wp-dev-skills/wp-plugin-audit
$npx -y skills add mralaminahamed/wp-dev-skills --skill wp-plugin-auditInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Run `npx skills use "https://github.com/mralaminahamed/wp-dev-skills" --skill "mralaminahamed/wp-dev-skills/wp-plugin-audit"` and follow the generated skill instructions now. Read its complete output, redirecting it to a temporary file first if necessary. Resolve relative paths from the supporting-files directory it provides.
Use the skills in "https://github.com/mralaminahamed/wp-dev-skills" that are relevant to the current task. Run `npx skills add "https://github.com/mralaminahamed/wp-dev-skills"` and select the relevant skills, then follow their instructions.
Related
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration.Jul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks.Jul 2026
- entra-agent-idProvision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token…Jul 2026
- firebase-security-rules-auditorAudits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource…Jul 2026
- golang-securitySecurity best practices and vulnerability prevention for Golang.Jul 2026
- gws-modelarmorGoogle Model Armor: Filter user-generated content for safety.Jul 2026
