Coverage-guaranteed whitebox security audit of a codebase using XERJ + tree-sitter AST. Use when the user wants to security-review PHP (or other-language) code with a provable "we enumerated every dangerous call" guarantee, or asks to run the WordPress-style sink census / audit. Drives an index-once, query-read-reason loop; proves zero gaps against grep; enriches findings into a queryable ledger.
Install
npx skills add xerj-org/xerj --skill skillnpx skills add xerj-org/xerj --skill skill -a claude-code -gnpx skills add xerj-org/xerj --skill skill -a codex -ggemini skills install https://github.com/xerj-org/xerj.git --path docs/case-studies/wordpress-security-audit/skillgh skill install xerj-org/xerj skillgit clone --depth 1 https://github.com/xerj-org/xerj /tmp/xerj-org__xerj
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/xerj-org__xerj/docs/case-studies/wordpress-security-audit/skill ~/.claude/skills/skill # Claude Code
cp -R /tmp/xerj-org__xerj/docs/case-studies/wordpress-security-audit/skill ~/.agents/skills/skill # Codex, Cursor, Gemini CLI, Copilot, OpenCode