wordpress-malware-removal v1.0.0A

Immutable. This exact content never changes and is served at /api/v1/blob/a13a79e09f052612.

---
name: wordpress-malware-removal
description: >
  Umbrella entry for the WordPress security suite — three agent skills on one gateway-agnostic engine
  that audit, clean, and harden a WordPress site end to end over any SSH+WP-CLI or WordPress MCP
  (SproutOS recommended). Use this to route to the right skill: wp-security-audit (read-only "how
  hackable am I?" A–F posture score), wp-malware-removal (clean a hacked site — cloaking, backdoors,
  database injection, web-shells — quarantine-first with rollback), and wp-hardening (idempotent,
  reversible hardening). Run ./install.sh to install all three. Use when a WordPress site is hacked,
  shows gambling/pharma spam in Google, needs a security audit, or needs hardening.
license: AGPL-3.0-or-later
metadata:
  author: Aditya Sharma (adityaarsharma.com)
  version: 1.0.0
  homepage: https://github.com/adityaarsharma/wordpress-malware-removal
---

# WordPress Malware Removal — suite router

This repository ships **three self-contained skills** on one shared, gateway-agnostic engine. This root
file is just the router — the real skills live in `skills/` and are installed with `./install.sh`.

| Skill | Use it when | Where |
|---|---|---|
| **wp-security-audit** | "How hackable is this site?" — read-only A–F posture score + ranked fixes. Touches nothing. | `skills/wp-security-audit/SKILL.md` |
| **wp-malware-removal** | "This site is hacked — clean it." 12-layer forensic scan → verify → quarantine-first removal → prove clean. | `skills/wp-malware-removal/SKILL.md` |
| **wp-hardening** | "Lock the doors." Idempotent, reversible hardening — auto-applies safe fixes, asks before risky. | `skills/wp-hardening/SKILL.md` |

## How to use
1. **Install:** `./install.sh` copies all three skills (self-contained: `SKILL.md` + `scripts/` +
   `references/`) into your agent's skills directory (default `~/.claude/skills`; `--dir` for
   Codex/Cursor/other; `--skill <name>` for one; `--uninstall` to remove).
2. **Connect a gateway:** SproutOS MCP (recommended), any other WordPress MCP, or plain SSH+WP-CLI. The
   shared contract is `references/gateway.md`.
3. **Route by need:** unsure? Run **wp-security-audit** first — it tells you whether to Remove, Harden,
   or relax.

## Shared safety DNA (all three skills)
Read before you act · never irreversible without a restore point · backup is the user's and is enforced,
never self-served · quarantine before delete · health-check after every destructive step, auto-rollback
on regression · unsure → NEEDS_HUMAN, never auto-delete · honest coverage gaps over silent "all clear."

See `README.md` for the full guide, `SPEC.md` for the product/security spec, `ROADMAP.md` for status,
and `docs/research-2026-07-wp-security.md` for the sourced research behind the detection/hardening/audit
methodology.