Imported from adityaarsharma/wordpress-malware-removal (SKILL.md). Install upstream with npx skills add adityaarsharma/wordpress-malware-removal. Copyright stays with the author (AGPL-3.0-or-later).

WordPress Malware Removal — suite router

Name: wordpress-malware-removal
Author: adityaarsharma

This repository ships three self-contained skills on one shared, gateway-agnostic engine. This root file is just the router — the real skills live in skills/ and are installed with ./install.sh.

Skill	Use it when	Where
wp-security-audit	"How hackable is this site?" — read-only A–F posture score + ranked fixes. Touches nothing.	`skills/wp-security-audit/SKILL.md`
wp-malware-removal	"This site is hacked — clean it." 12-layer forensic scan → verify → quarantine-first removal → prove clean.	`skills/wp-malware-removal/SKILL.md`
wp-hardening	"Lock the doors." Idempotent, reversible hardening — auto-applies safe fixes, asks before risky.	`skills/wp-hardening/SKILL.md`

How to use

Install: ./install.sh copies all three skills (self-contained: SKILL.md + scripts/ + references/) into your agent's skills directory (default ~/.claude/skills; --dir for Codex/Cursor/other; --skill <name> for one; --uninstall to remove).
Connect a gateway: SproutOS MCP (recommended), any other WordPress MCP, or plain SSH+WP-CLI. The shared contract is references/gateway.md.
Route by need: unsure? Run wp-security-audit first — it tells you whether to Remove, Harden, or relax.

Shared safety DNA (all three skills)

Read before you act · never irreversible without a restore point · backup is the user's and is enforced, never self-served · quarantine before delete · health-check after every destructive step, auto-rollback on regression · unsure → NEEDS_HUMAN, never auto-delete · honest coverage gaps over silent "all clear."

See README.md for the full guide, SPEC.md for the product/security spec, ROADMAP.md for status, and docs/research-2026-07-wp-security.md for the sourced research behind the detection/hardening/audit methodology.

{ "ocm": "1", "id": "adityaarsharma-wordpress-malware-removal-wordpress-malwa-670468", "kind": "skill", "name": "wordpress-malware-removal", "description": "Umbrella entry for the WordPress security suite — three agent skills on one gateway-agnostic engine that audit, clean, and harden a WordPress site end to end over any SSH+WP-CLI or WordPress MCP (SproutOS recommended). Use this to route to the right skill: wp-security-audit (read-only \"how hackable am I?\" A–F posture score), wp-malware-removal (clean a hacked site — cloaking, backdoors, database injection, web-shells — quarantine-first with rollback), and wp-hardening (idempotent, reversible hardening). Run ./install.sh to install all three. Use when a WordPress site is hacked, shows gambling/pharma spam in Google, needs a security audit, or needs hardening.", "publisher": "adityaarsharma", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "github" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Umbrella entry for the WordPress security suite — three agent skills on one gateway-agnostic engine that audit, clean, and harden a WordPress site end to end over any SSH+WP-CLI or WordPress MCP (SproutOS recommended). Use this to route to the right skill: wp-security-audit (read-only \"how hackable am I?\" A–F posture score), wp-malware-removal (clean a hacked site — cloaking, backdoors, database injection, web-shells — quarantine-first with rollback), and wp-hardening (idempotent, reversible hardening). Run ./install.sh to install all three. Use when a WordPress site is hacked, shows gambling/pharma spam in Google, needs a security audit, or needs hardening." ], "primary": false, "metadata": { "source": { "provider": "github", "repository": "https://github.com/adityaarsharma/wordpress-malware-removal", "path": "SKILL.md", "ref": "e76d010a2b3aa130192bebd7ddfbb4f9c6e829fa", "url": "https://github.com/adityaarsharma/wordpress-malware-removal/blob/e76d010a2b3aa130192bebd7ddfbb4f9c6e829fa/SKILL.md", "key": "adityaarsharma/wordpress-malware-removal/SKILL.md" }, "license": "AGPL-3.0-or-later" }, "instructions": "# WordPress Malware Removal — suite router\n\nThis repository ships **three self-contained skills** on one shared, gateway-agnostic engine. This root\nfile is just the router — the real skills live in `skills/` and are installed with `./install.sh`.\n\n| Skill | Use it when | Where |\n|---|---|---|\n| **wp-security-audit** | \"How hackable is this site?\" — read-only A–F posture score + ranked fixes. Touches nothing. | `skills/wp-security-audit/SKILL.md` |\n| **wp-malware-removal** | \"This site is hacked — clean it.\" 12-layer forensic scan → verify → quarantine-first removal → prove clean. | `skills/wp-", "cost": { "context_tokens": 476 } }

wordpress-malware-removal

About

WordPress Malware Removal — suite router

How to use

Shared safety DNA (all three skills)

Use it

Manifest

Reviews