wordpress-security-review

# WordPress Security Review Runs the security audit built into Respira, explains what it found in plain words, and fixes what can be fixed, one approved step at a time. ## What this skill does A security check an agent improvises usually grades a site on whether a security plugin is installed. That says nothing about whether the site is patched, whether an administrator appeared last week, or whether the uploads folder runs PHP. The Respira audit answers those questions from evidence WordPress itself can verify, and it says which questions it could not answer. This skill runs it, reads every part of the result, and keeps the report honest: a check that did not run is reported as not run, a scan that hit its limit is reported as partial, and a vulnerability database that could not be reached means "not checked", never "clean". **Handles:** - The audit: core checksums, administrators and their application passwords, plugins, themes, must-use plugins, cron hooks, indicators and coverage - Known vulnerabilities: installed core, plugin and theme versions matched against the Wordfence vulnerability database (plugin 9.0 and later) - The uploads execution probe, only with the owner's consent - Fixes: plugin, theme and core security updates behind approval, and credential clean-up with explicit consent - A second audit after the fixes, saying what cleared and what remains ## What this skill does NOT do - **Call a site clean when it could not look.** Partial coverage, a check th...