XERJ whitebox security audit

Run a security review where XERJ is the agent's second brain: index the code once, then interrogate it — never load whole files. The deliverable is a defensible coverage claim, not a vibe. Scripts referenced below live in docs/case-studies/wordpress-security-audit/sink-census/ (copy them alongside this skill to reuse in another repo).

When to use

• "Security-review this codebase / WordPress plugin / PHP app with coverage."
• "Find the dangerous calls / sinks and prove we didn't miss any."
• "Run the sink census / audit ledger."

Prerequisites (state them, then set up)

• XERJ running, ES-compatible, on http://127.0.0.1:9200 (xerj --insecure --data-dir ./data).
• pip install tree-sitter tree-sitter-php (+ the grammar for the target language).
• The target source tree on disk.

The loop (do these in order; report honestly at each step)