Security auditing & code review

When to use this skill

Use this skill when the task is to evaluate code rather than write a feature:

• Reviewing a PR/plugin/theme for security defects.
• Auditing inherited or third-party code before deploying it.
• Triaging a reported vulnerability or suspicious behavior.
• Producing a security findings report with severities and fixes.

This skill is the audit counterpart to the secure-coding skills. When you find an issue, fix it using the relevant skill (nonces-csrf-protection, output-escaping, sql-injection-prevention, etc.).

Operating modes