dotfiles

Audit WordPress Gutenberg blocks for stored XSS vulnerabilities in render_callback functions. Traces how $attributes (user-controlled values) flow through PHP render callbacks into HTML output, flagging insufficient or incorrect escaping. Trigger phrases: "WordPress block security", "XSS in blocks", "audit render_callback", "block attribute sanitization", "Gutenberg security audit", "wp-block-security"

Comprehensive WordPress security auditor detecting XSS, SQLi, CSRF, SSRF, LFI, Object Injection, Command Injection, Auth Bypass, and more. Integrates wp-block-security for specialized Gutenberg block XSS detection. Uses parallel subagents for efficient, thorough security analysis. Trigger phrases: "WordPress security audit", "security review", "wp-security-review", "audit WordPress code", "find vulnerabilities"

Resolve review comments on GitHub PRs — fetches unresolved review threads, evaluates each suggestion against the codebase, applies valid fixes in a single commit, replies to every comment explaining what was done and why, and resolves them all. Works with any reviewer: Copilot, Dependabot, human teammates, or any other source. Use this skill whenever the user mentions PR feedback, review comments, copilot suggestions, or wants to process/address/resolve review threads. Also trigger when the user says things like "handle the review comments", "address the PR feedback", "deal with the review suggestions", "clean up the PR reviews", "review the comments on my PR", "check the PR feedback", "look at the review comments on this PR", or "resolve the review threads".

Run the full dev team — plan, implement, review, learn

Review changes and create a commit

Record a learning to the team's persistent memory

Review current changes before committing

Quick status — 5-second context recovery

End session — commit and write session memo