@respira/wordpress-mcp-server 8.3.24 → 8.3.25

package/skills/seo-aeo-amplifier/SKILL.md

@@ -1,6 +1,18 @@
+---
+name: seo-aeo-amplifier
+description: "Use when the user says 'run an seo aeo audit', 'improve my search visibility', 'optimize my site for search engines', or wants the site cited by AI answer engines. Audits on-page SEO and AEO, generates schema markup, and applies fixes on duplicates for review after a snapshot."
+license: MIT
+metadata:
+  author: Respira for WordPress
+  author_url: https://respira.press
+  version: 1.3.1
+  mcp-server: respira-wordpress
+  category: performance
+---
+
 # SEO & AEO Amplifier
 
-**Version:** 1.3.0
+**Version:** 1.3.1
 **Updated:** 2026-06-30
 **Freshly updated:** v1.3.0 takes a snapshot with respira_get_snapshot before any edit so every change is one-click reversible, switches from full extract/inject to surgical respira_find_element + respira_update_element edits for meta titles, descriptions and H1s, applies schema and meta across many pages in a single safe pass with respira_batch_update, and wires respira_generate_activity_report into the "SEO work done -> client report" handoff. Also leans on the real SEO analysis tools (respira_analyze_seo, respira_analyze_aeo, respira_analyze_rankmath, respira_check_seo_issues, respira_check_structured_data) instead of hand-rolled scoring.
 
@@ -244,7 +256,7 @@ It can:
 - `respira_restore_snapshot` (one-click rollback)
 
 **Reporting**
-- `respira_generate_activity_report` (SEO work done -> client report)
+- `respira_generate_activity_report` (SEO work done -> client report; plugin 9.0 and later list it as a tool; on older plugins call `respira_invoke_ability` with `ability: "respira/generate-activity-report"` and the same arguments under `args`)
 
 **WooCommerce tools (optional)**
 - `woocommerce_list_products`

package/skills/seo-aeo-amplifier/metadata.json

@@ -12,8 +12,8 @@
   "requires_accessibility_addon": false,
   "is_read_only": false,
   "is_duplicate_first": true,
-  "version": "1.2.0",
-  "last_updated": "2026-05-24",
+  "version": "1.3.1",
+  "last_updated": "2026-09-13",
   "tools_used": [
     "respira_get_site_context",
     "respira_list_pages",

package/skills/stale-content-detector/SKILL.md

@@ -1,3 +1,15 @@
+---
+name: stale-content-detector
+description: "Use when the user says 'find old content', 'what is stale', 'what needs refreshing', or 'what should i archive'. Categorizes pages and posts as fresh, aging, stale, or archive-candidate by age, traffic signal, and internal link count, with a refresh, redirect, or archive call per item."
+license: MIT
+metadata:
+  author: Respira for WordPress
+  author_url: https://respira.press
+  version: 1.0.0
+  mcp-server: respira-wordpress
+  category: audit
+---
+
 # Stale Content Detector
 
 **Version:** 1.0.0

package/skills/technical-debt-audit/SKILL.md

@@ -1,6 +1,18 @@
+---
+name: technical-debt-audit
+description: "Use when the user says 'clean up my wordpress', 'what is bloating my wordpress', 'find orphaned shortcodes', or 'scan for unused plugins'. Audits orphaned shortcodes from deleted plugins, unused plugins, database bloat, unused media, and leftover data from inactive builders."
+license: MIT
+metadata:
+  author: Respira for WordPress
+  author_url: https://respira.press
+  version: 1.2.1
+  mcp-server: respira-wordpress
+  category: audit
+---
+
 # Technical Debt Audit
 
-**Version:** 1.2.0
+**Version:** 1.2.1
 **Updated:** 2026-06-30
 **Freshly updated:** v1.2.0 turns the audit into safe, reversible cleanup. Every debt type now has a per-type cleanup playbook that opens with a `respira_get_snapshot` checkpoint and ends with an explicit `respira_restore_snapshot` rollback. Orphaned-shortcode findings are validated with `respira_find_element` before any edit. The per-site debt score is persisted via `respira_get_option` / `respira_update_option` so re-runs show the trend. The cleanup narrative is generated with `respira_generate_activity_report`. Builder archaeology now covers the newer block builders (Spectra, Kadence Blocks, GenerateBlocks, SeedProd) alongside the classic 16.
 **Category:** audit
@@ -550,7 +562,7 @@ All tools below are provided by the `respira-wordpress` MCP server. Never call t
 | `respira_find_element` | Validate an orphaned shortcode is a live element | `{ pageId, ... }` |
 | `respira_get_snapshot` | Checkpoint before any cleanup (rollback handle) | none |
 | `respira_restore_snapshot` | Roll a cleanup back to the checkpoint | `{ snapshot_id }` |
-| `respira_generate_activity_report` | Structured totals for the cleanup narrative | none |
+| `respira_generate_activity_report` | Structured totals for the cleanup narrative (plugin 9.0 and later list it as a tool; on older plugins call `respira_invoke_ability` with `ability: "respira/generate-activity-report"` and the same arguments under `args`) | none |
 
 > Cleanup tools used inside the playbooks above — `respira_create_page_duplicate`, `respira_create_post_duplicate`, `respira_remove_element`, `respira_batch_update`, `respira_deactivate_plugin`, `respira_activate_plugin`, `respira_delete_plugin` — are also `respira-wordpress` MCP tools. Use only tools from this server; never invent a tool name.
 

package/skills/woo-marketing-campaigns/SKILL.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   author: "Respira for WordPress"
   author_url: https://respira.press
-  version: 1.0.0
+  version: 1.0.1
   mcp-server: respira-wordpress
   category: commerce
 ---
@@ -39,7 +39,7 @@ So this reads sales, stock and catalogue quality before it writes a word, then d
 ## Requirements
 
 - WooCommerce with the Respira WooCommerce add-on, licensed
-- Enough order history for `get-sales-report` to say something useful. On a store with almost no orders, say that plainly and plan from stock and margin instead of pretending the data speaks.
+- Enough order history for `woocommerce_top_products` and `woocommerce_revenue_summary` to say something useful. On a store with almost no orders, say that plainly and plan from stock and margin instead of pretending the data speaks.
 
 ## Trigger Phrase
 
@@ -56,10 +56,10 @@ So this reads sales, stock and catalogue quality before it writes a word, then d
 
 ### Phase 1: Read the shop
 
-1. `get-sales-report` over the last 30 and 90 days. What sells, what is seasonal, what has stalled.
-2. `list-products-advanced` for stock and price on the candidates. A hero product that goes out of stock on day two is a campaign that ends on day two.
-3. `find-low-stock` to rule those out early.
-4. `analyze-catalog-quality` on the shortlist. A product with no image and a twelve-word description will not convert however good the campaign is, and fixing that comes first.
+1. `woocommerce_top_products` and `woocommerce_revenue_summary` over the last 30 and 90 days (pass `date_start` and `date_end`), then `woocommerce_sales_timeseries` with `interval: week`. What sells, what is seasonal, what has stalled.
+2. `woocommerce_list_products_advanced` for stock and price on the candidates. A hero product that goes out of stock on day two is a campaign that ends on day two.
+3. `woocommerce_find_low_stock` to rule those out early.
+4. `woocommerce_catalog_health` for the store, then `woocommerce_product_ai_readiness` on each shortlisted product. A product with no image and a twelve-word description will not convert however good the campaign is, and fixing that comes first.
 
 ### Phase 2: Propose, do not assume
 
@@ -78,7 +78,7 @@ If the promoted products have catalogue gaps, fix those first with Woo Catalog P
 ### Phase 4: Draft
 
 - Landing or category copy through `respira_create_page_duplicate` and the builder tools, never onto the live page
-- `update-product` for descriptions on the promoted set, staged
+- `woocommerce_update_product` for descriptions on the promoted set, staged
 - The offer itself through Woo Pricing and Promotions, previewed with `dry_run` first
 
 Every claim traces to something read in Phase 1. Prices come from the product, availability comes from stock, delivery claims come from the shipping settings or are not made.
@@ -87,9 +87,11 @@ Every claim traces to something read in Phase 1. Prices come from the product, a
 
 List the drafts, their preview links, and what remains a human decision: approving the pages, sending whatever is being sent, and the date the offer ends.
 
+For each draft page, `respira_create_share_link` gives a link anyone can open with no WordPress login. When the owner wants the people who sign off to comment on the page itself, send a Murmur review link instead (`respira_create_review_link`, Builder plan and up; on a lower plan the tool answers `respira_murmur_plan`, so fall back to the share link). The Murmur Review Loop skill picks up their notes.
+
 ### Phase 6: Afterwards
 
-When the campaign has run, `get-sales-report` for the window and compare against the plan. Say what worked and what did not, including when the answer is that the campaign made no measurable difference.
+When the campaign has run, `woocommerce_top_products` and `woocommerce_revenue_summary` for the window, and `woocommerce_agent_orders_report` for orders that arrived through agent cart links, and compare against the plan. Say what worked and what did not, including when the answer is that the campaign made no measurable difference.
 
 ## Safety Model
 
@@ -109,7 +111,7 @@ It can: pick candidates from real sales and stock rather than plausibility, stop
 
 ## Tooling
 
-`respira_woo_get-sales-report`, `respira_woo_agent-orders-report`, `respira_woo_list-products-advanced`, `respira_woo_find-low-stock`, `respira_woo_analyze-catalog-quality`, `respira_woo_update-product`, `respira_woo_create-coupon`, `respira_woo_schedule-sale`, `respira_create_page_duplicate`, `respira_update_element`, `respira_get_snapshot`
+`woocommerce_top_products`, `woocommerce_revenue_summary`, `woocommerce_sales_timeseries`, `woocommerce_agent_orders_report`, `woocommerce_list_products_advanced`, `woocommerce_find_low_stock`, `woocommerce_catalog_health`, `woocommerce_product_ai_readiness`, `woocommerce_update_product`, `woocommerce_create_coupon`, `woocommerce_schedule_sale`, `respira_create_page_duplicate`, `respira_update_element`, `respira_get_snapshot`, `respira_create_share_link`, `respira_create_review_link`
 
 ## Telemetry
 
@@ -120,6 +122,7 @@ After run completion, fire-and-forget to `POST https://www.respira.press/api/ski
 - Woo Pricing and Promotions (the offer the campaign runs on)
 - Woo Catalog Perfection (fix the products before promoting them)
 - Brand Voice Synthesizer (write in the store's own voice)
+- Murmur Review Loop (collect and apply the sign-off notes)
 - SEO & AEO Amplifier (make the campaign page findable)
 
 ---

package/skills/woo-pricing-promotions/SKILL.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   author: "Respira for WordPress"
   author_url: https://respira.press
-  version: 1.0.0
+  version: 1.0.1
   mcp-server: respira-wordpress
   category: commerce
 ---
@@ -35,7 +35,7 @@ Pricing is the one place on a store where a plausible-looking mistake costs real
 ## Requirements
 
 - WooCommerce with the Respira WooCommerce add-on, licensed
-- The store's own reporting for volume, which `get-sales-report` reads
+- The store's own sales history for volume, which `woocommerce_top_products` reads
 
 ## Trigger Phrase
 
@@ -55,8 +55,8 @@ Pricing is the one place on a store where a plausible-looking mistake costs real
 
 Never reprice from memory of what a product costs.
 
-1. `respira_woo_list-products-advanced` for the target set, or `get-product` for a named one. This also matters mechanically: reads are what the add-on records as provenance, and a write to something never read is annotated as unverified.
-2. `get-sales-report` over a comparable recent window, so the discount has a volume to be measured against.
+1. `woocommerce_list_products_advanced` for the target set, or `woocommerce_get_product` for a named one. This also matters mechanically: reads are what the add-on records as provenance, and a write to something never read is annotated as unverified.
+2. `woocommerce_top_products` over a comparable recent window (`date_start`, `date_end`), so the discount has a volume to be measured against.
 3. Note anything already on sale. Stacking a new sale on an existing one is the most common way a discount ends up twice as deep as intended.
 
 ### Phase 2: State it in money
@@ -73,15 +73,15 @@ Run the write with `dry_run: true` first, every time. The response lists each pr
 
 ### Phase 4: Write
 
-- `bulk-update-prices` for a repricing, or `schedule-sale` when it should end by itself
-- `create-coupon` for a code, with `usage_limit` set unless the user says otherwise, because an uncapped code is a liability
-- `add-sale-badge` if the storefront should show it
+- `woocommerce_bulk_update_prices` for a repricing (`change_type` percentage, absolute or set_value; `apply_to` regular_price, sale_price or both), or `woocommerce_schedule_sale` when it should end by itself
+- `woocommerce_create_coupon` for a code, with `usage_limit` set unless the user says otherwise, because an uncapped code is a liability
+- `woocommerce_add_sale_badge` if the storefront should show it (block themes only; run it with `dry_run: true` first)
 
 Snapshots are captured automatically. Report the snapshot ids.
 
 ### Phase 5: Confirm and hand back the undo
 
-State what changed, in money, and how to reverse it: `revert-pricing` with the product and snapshot id. If the sale was scheduled, say the date it ends without anyone acting.
+State what changed, in money, and how to reverse it: `woocommerce_revert_pricing` with the `product_id` and `snapshot_id`. If the sale was scheduled, say the date it ends without anyone acting.
 
 ## Safety Model
 
@@ -101,7 +101,7 @@ It can: show what a change costs before it happens, apply it consistently across
 
 ## Tooling
 
-`respira_woo_list-products-advanced`, `respira_woo_get-product`, `respira_woo_get-sales-report`, `respira_woo_bulk-update-prices`, `respira_woo_schedule-sale`, `respira_woo_revert-pricing`, `respira_woo_create-coupon`, `respira_woo_update-coupon`, `respira_woo_list-coupons`, `respira_woo_add-sale-badge`
+`woocommerce_list_products_advanced`, `woocommerce_get_product`, `woocommerce_top_products`, `woocommerce_revenue_summary`, `woocommerce_bulk_update_prices`, `woocommerce_schedule_sale`, `woocommerce_revert_pricing`, `woocommerce_create_coupon`, `woocommerce_update_coupon`, `woocommerce_list_coupons`, `woocommerce_add_sale_badge`
 
 ## Telemetry
 

package/skills/woocommerce-health-check/SKILL.md

@@ -1,8 +1,21 @@
+---
+name: woocommerce-health-check
+description: "Use when the user says 'why is my checkout broken', 'audit my woocommerce store', 'cart problems woocommerce', or 'losing sales woocommerce'. Diagnoses checkout and cart failures, AJAX mismatches, caching conflicts, payment gateway setup, and SSL enforcement."
+license: MIT
+metadata:
+  author: Respira for WordPress
+  author_url: https://respira.press
+  version: 1.2.1
+  mcp-server: respira-wordpress
+  category: audit
+  requires-addon: woocommerce
+---
+
 # WooCommerce Health Check
 
-**Version:** 1.2.0
+**Version:** 1.2.1
 **Updated:** 2026-06-30
-**Freshly updated:** v1.2.0 adds real order/sales/stock diagnostics via the woocommerce_* read tools (woocommerce_list_orders, woocommerce_sales_report, woocommerce_get_stock_status), gives every detected issue a concrete safe-fix suggestion, uses respira_find_element to locate and validate the actual cart/checkout widgets and blocks, snapshots with respira_get_snapshot before any fix, and frames respira_generate_activity_report as a "prevented X lost orders / revenue protected" report.
+**Freshly updated:** v1.2.0 adds real order/sales/stock diagnostics via the woocommerce_* read tools (woocommerce_list_orders, woocommerce_revenue_summary, woocommerce_get_stock_status), gives every detected issue a concrete safe-fix suggestion, uses respira_find_element to locate and validate the actual cart/checkout widgets and blocks, snapshots with respira_get_snapshot before any fix, and frames respira_generate_activity_report as a "prevented X lost orders / revenue protected" report.
 **Category:** audit
 **Status:** active
 **Requires:** Respira for WordPress plugin + MCP server + WooCommerce (`requires_addon: woocommerce`)
@@ -129,11 +142,12 @@ Look at order status mix over a recent window:
 - Many `cancelled` after `pending` can mean session/cart loss before payment.
 
 ```
-Tool: woocommerce_sales_report
-Returns: Sales totals over a period
+Tool: woocommerce_revenue_summary
+Args: date_start, date_end (store timezone; default the last 30 days)
+Returns: Gross, discounts, refunds, tax, shipping and net revenue over the period, with the statuses counted and how many orders it covered
 ```
 
-Use the sales report to size the impact: a sudden drop against a prior period quantifies how much revenue the configuration issues are putting at risk, which feeds the "revenue protected" framing in the final report.
+Use the revenue summary to size the impact: run it for the recent window and for the period before it, and a sudden drop between the two quantifies how much revenue the configuration issues are putting at risk, which feeds the "revenue protected" framing in the final report.
 
 ```
 Tool: woocommerce_get_stock_status
@@ -372,7 +386,7 @@ This skill is read-only by default. When the user approves a fix, every change f
 After the audit (and any approved fixes), turn the work into a store-owner-facing report with `respira_generate_activity_report`.
 
 Frame it around protected revenue, not raw tool calls:
-- Tie the failed/pending order rate and the `woocommerce_sales_report` drop you measured in Step 4 to an estimate of orders that were being lost.
+- Tie the failed/pending order rate and the `woocommerce_revenue_summary` drop you measured in Step 4 to an estimate of orders that were being lost.
 - After fixes, state what was restored: "checkout widget re-inserted, caching exclusions added, X products corrected back in stock."
 - The activity report becomes the "prevented X lost orders / revenue protected" summary the owner can keep or hand to a client, with the snapshot id as the documented rollback point.
 
@@ -556,9 +570,9 @@ All tools below are provided by the `respira-wordpress` MCP server. Never call t
 | `respira_get_snapshot` | Snapshot before any fix (rollback point) | none |
 | `respira_restore_snapshot` | Roll back to a snapshot if a fix has side effects | snapshot id |
 | `respira_create_page_duplicate` | Duplicate-first page fixes (checkout/cart/mobile) | `{ id }` |
-| `respira_generate_activity_report` | "Revenue protected / prevented X lost orders" report | none |
+| `respira_generate_activity_report` | "Revenue protected / prevented X lost orders" report (plugin 9.0 and later list it as a tool; on older plugins call `respira_invoke_ability` with `ability: "respira/generate-activity-report"` and the same arguments under `args`) | none |
 | `woocommerce_list_orders` | Recent orders + status mix (failed/pending signal) | none |
-| `woocommerce_sales_report` | Sales totals over a period (size the impact) | period |
+| `woocommerce_revenue_summary` | Revenue over a period, net of refunds (size the impact) | date_start, date_end |
 | `woocommerce_get_stock_status` | Stock state per product (silent lost-sale flags) | none |
 | `woocommerce_update_stock` | Correct a confirmed stock data error (after snapshot) | product + stock |
 

package/skills/wordpress-ai-image-optimizer/SKILL.md

@@ -1,6 +1,18 @@
+---
+name: wordpress-ai-image-optimizer
+description: "Use when the user says 'optimize my wordpress images with ai', 'compress and optimize all images', 'audit my media library', or 'improve image performance'. Downloads images, compresses, converts to WebP, resizes and renames locally, re-uploads, and updates every content reference."
+license: MIT
+metadata:
+  author: Respira for WordPress
+  author_url: https://respira.press
+  version: 1.2.1
+  mcp-server: respira-wordpress
+  category: performance
+---
+
 # WordPress AI Image Optimizer
 
-**Version:** 1.2.0
+**Version:** 1.2.1
 **Updated:** 2026-06-30
 **Freshly updated:** v1.2.0 replaces per-image `respira_update_media` loops with a single `respira_update_media_batch` pass (up to ~50 items at once), snapshots the media library with `respira_get_snapshot` before the batch so the whole run is one-step reversible, runs the audit through `respira_analyze_images`, surfaces optional stock replacements via `respira_search_stock_images` + `respira_sideload_image`, and closes with a `respira_generate_activity_report` summary (e.g. "optimized 47 images, saved 1.2GB").
 
@@ -197,7 +209,7 @@ Uses these Respira MCP tools:
 - `respira_restore_snapshot` (one-step revert)
 
 **Reporting:**
-- `respira_generate_activity_report` (run summary: images optimized, space saved, alt text added)
+- `respira_generate_activity_report` (run summary: images optimized, space saved, alt text added; plugin 9.0 and later list it as a tool; on older plugins call `respira_invoke_ability` with `ability: "respira/generate-activity-report"` and the same arguments under `args`)
 
 **Content Scanning:**
 - `respira_list_pages`

package/skills/wordpress-ai-image-optimizer/metadata.json

@@ -12,8 +12,8 @@
   "requires_accessibility_addon": false,
   "is_read_only": false,
   "is_duplicate_first": true,
-  "version": "1.1.0",
-  "last_updated": "2026-05-24",
+  "version": "1.2.1",
+  "last_updated": "2026-09-13",
   "tools_used": [
     "respira_list_media",
     "respira_get_media",

package/skills/wordpress-security-review/SKILL.md

@@ -0,0 +1,154 @@
+---
+name: wordpress-security-review
+description: "Use when the user asks 'is my site secure', 'run a security audit', 'check for vulnerabilities', 'was my site hacked', or 'fix the vulnerable plugins'. Runs the Respira security audit, reads its indicators, coverage and known vulnerabilities honestly, never calls a partial scan clean, and fixes what it finds one approved step at a time."
+license: MIT
+metadata:
+  author: Respira for WordPress
+  author_url: https://respira.press
+  version: 1.0.0
+  mcp-server: respira-wordpress
+  category: audit
+  respira_min_version: 9.0.0
+---
+
+# WordPress Security Review
+
+Runs the security audit built into Respira, explains what it found in plain words, and fixes what can be fixed, one approved step at a time.
+
+## What this skill does
+
+A security check an agent improvises usually grades a site on whether a security plugin is installed. That says nothing about whether the site is patched, whether an administrator appeared last week, or whether the uploads folder runs PHP. The Respira audit answers those questions from evidence WordPress itself can verify, and it says which questions it could not answer.
+
+This skill runs it, reads every part of the result, and keeps the report honest: a check that did not run is reported as not run, a scan that hit its limit is reported as partial, and a vulnerability database that could not be reached means "not checked", never "clean".
+
+**Handles:**
+- The audit: core checksums, administrators and their application passwords, plugins, themes, must-use plugins, cron hooks, indicators and coverage
+- Known vulnerabilities: installed core, plugin and theme versions matched against the Wordfence vulnerability database (plugin 9.0 and later)
+- The uploads execution probe, only with the owner's consent
+- Fixes: plugin, theme and core security updates behind approval, and credential clean-up with explicit consent
+- A second audit after the fixes, saying what cleared and what remains
+
+## What this skill does NOT do
+
+- **Call a site clean when it could not look.** Partial coverage, a check that did not run, or an unavailable vulnerability database are reported as exactly that.
+- **Delete, deactivate or replace anything without asking.** Not plugins, not users, not files. The audit never runs clean-up queries, and neither does this skill.
+- **Revoke a credential on its own judgement.** An application password is revoked only when the owner names it and says yes.
+- **See the host.** Server cron, access logs, wp-config secrets and backups are outside what WordPress can verify. The audit says so in `coverage`, and so does the report.
+- **Replace a forensic investigation.** Indicators are questions. A confirmed break-in needs the host and a professional.
+
+## Requirements
+
+- Respira for WordPress 9.0 or later for the known-vulnerability match, `respira_update_theme` and `respira_revoke_application_password`. On 8.x the audit still runs: say that the vulnerability match needs plugin 9.0, and list themes to update by hand.
+- Plugin management switched on in Respira settings, for plugin and theme updates.
+- A recent backup the owner can restore, confirmed before any update. Respira's page snapshots do not cover plugin, theme or core files.
+- A connection made with an administrator's key. From 9.0 the audit answers administrators only, because its result names every administrator and credential.
+
+## Trigger Phrase
+
+- "is my site secure"
+
+## Alternative Triggers
+
+- "run a security audit"
+- "check for vulnerabilities"
+- "was my site hacked"
+- "fix the vulnerable plugins"
+- "security review"
+
+## Execution Workflow
+
+### Phase 1: Run the audit
+
+1. `respira_get_site_context` to confirm the site and its Respira plugin version.
+2. `respira_run_security_audit` with `deep_scan: true`. The deep scan inspects uploads, wp-content/cache and must-use plugin paths for executable files, within strict time, file and result limits. On plugin 9.0 and later it only reads. On older plugins it also writes and deletes one inert probe file in uploads, so ask the owner first there, because file-change monitors may report it.
+3. Leave `probe_uploads_execution` off for now. Phase 3 asks for it.
+
+### Phase 2: Read the whole result
+
+Read every block and report each one in plain words:
+
+- **`indicators`**: each has an `id`, a `severity` and a `summary`, and its `evidence` often carries a `note`. Report every indicator with its summary and note. An indicator is a question, not a verdict: `recent-administrator` looks the same for an account the owner added last week, which is why it asks.
+- **`coverage`**: what was and was not checked.
+  - `executable_file_scan` is `complete`, `partial` (the bounded scan reached a limit) or `not_run`. Partial or not run means the uploads were not fully checked; never describe them as clean.
+  - `host_cron`, `host_access_logs`, `wp_config_secrets` and `external_backup_state` are false: Respira cannot see these. Say so once.
+  - `application_passwords`, `database_file_privilege` and `wp2shell_database_artifacts` say whether each check completed or was unavailable.
+  - `recent_administrators` gives the window in days and how many accounts it flagged, so a 0 is read against how far back it looked.
+- **`known_vulnerabilities`** (plugin 9.0 and later): installed software matched against the vulnerability database. Its `status` is `ok` when the match ran, and then every match carries the version that fixes it: report them most severe first. `unavailable` means the database could not be consulted, and `reason` says why (for example, no Respira licence is connected); `not_run` means the call switched it off. In both cases, and when the block is missing because the plugin is older, say the vulnerability check did not run. Only `ok` with no matches means no known vulnerabilities were found. `coverage.known_vulnerabilities` repeats the status.
+- **`checks`**: the evidence behind the indicators (core checksums, administrators and their application passwords, plugins, themes). Use it to answer follow-up questions, not to pad the report.
+- **`warnings`**: repeat each one. They are written for the owner.
+
+Build the verdict only from what ran. When coverage is partial, the vulnerability check did not run, or a high-severity indicator is present, the report cannot say "clean" or "secure". Say "no problems found in what was checked", then name what was not checked.
+
+### Phase 3: The uploads probe, only with consent
+
+`probe_uploads_execution: true` tests whether the web server would run PHP from the uploads folder, which is the difference between a stray file and a working backdoor. It writes one inert PHP file to uploads, requests it and deletes it. Ask first, in words close to these:
+
+> One more check is available: whether your server would run a PHP file placed in uploads. It writes a harmless test file for a moment and deletes it. A security plugin or your host may log it as a new PHP file. Run it?
+
+Run it only on a yes, with the same `deep_scan` setting, and report the `uploads-execute-php` indicator if it appears.
+
+### Phase 4: Plan the fixes
+
+Before the first change, say in one line that an update replaces the software's files, that Respira's page snapshots do not cover those files, and that the host's backup is the way back. Then propose an ordered plan, most severe first:
+
+- Plugins with a known vulnerability and an update that reaches the fixed version
+- Themes with a known vulnerability
+- WordPress core, when the audit reports a security release for the site's own branch
+- Application passwords on administrator accounts the owner does not recognise
+- Anything with no published fix: recommend what to do and wait for the owner
+
+Do not add anything that is not on the list. If the update WordPress offers is lower than the fixed version, or no update is offered (common for premium plugins with a lapsed licence), do not force it: say which ones and why.
+
+### Phase 5: Fix, one approved step at a time
+
+Every fix tool here is approval-gated: the first call returns `respira_approval_required` with an `approval_token`, and repeating the same call with that token completes it. Tell the owner what the call will do before sending the token back.
+
+- **Plugins:** `respira_update_plugin` with the `slug`, one plugin at a time. After each one, load the home page; if it fails, stop the batch and report.
+- **Themes:** `respira_update_theme`, the same way.
+- **Core:** `respira_update_core_security` with the `advisory_id` and `target_version` the audit reported (never guessed), and `backup_confirmed: true` only after the owner confirms a recent backup. WordPress core has no automatic rollback, and the receipt says so.
+- **Application passwords:** `respira_revoke_application_password` only when the owner names the credential and says yes to revoking that one. Never revoke one because it looks old or unused, and never several in one go.
+- **Nothing else.** Never delete, deactivate or replace a plugin, delete a user or remove a file as part of a fix without asking first, even when an indicator points at it.
+
+### Phase 6: Check again
+
+1. Load the home page to confirm the site works.
+2. Run `respira_run_security_audit` again with the same options.
+3. Report what cleared, what remains, and what still needs a person: an update that was not offered, a credential the owner has not decided on, anything outside what WordPress can see.
+
+The security page in the respira.press dashboard has a "Fix in AER" link that starts this same flow in Respira AER.
+
+## Safety Model
+
+- Reads first; nothing changes before the owner sees the plan
+- The one check that writes, the uploads probe, runs only with consent and says what it will do
+- Every fix is approval-gated and runs one at a time, with a home-page check between steps
+- Nothing is deleted, deactivated or revoked without an explicit yes for that specific item
+- Partial, not run and unavailable are reported as such, never rounded up to clean
+- Updates have no Respira snapshot, so the owner's backup is confirmed first
+
+## Honest Disclaimer
+
+This skill reviews a WordPress site's security from inside WordPress.
+
+It cannot: see the server, its logs, its cron or its backups; prove a site was never compromised; or patch a plugin whose author has not published a fix.
+
+It can: check core files against WordPress.org, list every administrator and credential, match installed versions against a database of known vulnerabilities, find executable files where they should not be, and apply the published fixes one approved step at a time, then check again.
+
+## Tooling
+
+`respira_get_site_context`, `respira_run_security_audit`, `respira_list_plugins`, `respira_update_plugin`, `respira_update_theme`, `respira_update_core_security`, `respira_revoke_application_password`
+
+## Telemetry
+
+After run completion, fire-and-forget to `POST https://www.respira.press/api/skills/track-usage` with `skill_slug = wordpress-security-review`, site and version context, duration, indicator counts by severity, the number of known vulnerabilities and the number of fixes applied. No logins, credentials, file paths or IP addresses are sent. Never block the user on telemetry.
+
+## Related Skills
+
+- WordPress Site DNA (the wider archaeology; its security step uses this audit)
+- Respira Site Audit (SEO, accessibility and performance, with a security summary)
+- Technical Debt Audit (plugins nobody uses are attack surface too)
+
+---
+
+Built by Respira for WordPress
+https://respira.press/skills/wordpress-security-review

package/skills/wordpress-site-dna/README.md

@@ -40,7 +40,7 @@ check my wordpress setup
 ## File structure
 
 ```
-claude_skills/wordpress-site-dna/
+plugins/respira-wordpress/skills/wordpress-site-dna/
 ├── SKILL.md          ← Main skill definition (the actual skill)
 ├── README.md         ← This file
 ├── telemetry.ts      ← Telemetry helper functions

package/skills/wordpress-site-dna/SKILL.md

@@ -1,8 +1,21 @@
+---
+name: wordpress-site-dna
+description: "Use when the user says 'analyze my wordpress site', 'what is running on my site', 'site dna', or 'what plugins are on my site'. Detects every page builder, audits active versus dead-weight plugins, maps content structure, finds orphaned shortcodes, and checks performance and security posture."
+license: MIT
+metadata:
+  author: Respira for WordPress
+  author_url: https://respira.press
+  version: 1.3.0
+  mcp-server: respira-wordpress
+  category: audit
+  respira_min_version: 8.9.0
+---
+
 # WordPress Site DNA
 
-**Version:** 1.2.0
-**Updated:** 2026-05-24
-**Freshly updated:** v1.2.0 adds awareness of the full Divi 5 108-module catalog (was 16 hand-curated modules), the Elementor 4 atomic-write surface for site-wide audits, and the 4 new v7.1 builders. Integrates with respira_generate_activity_report for the 'site audit → client report' handoff. Cross-links to the new Activity Report Composer skill.
+**Version:** 1.3.0
+**Updated:** 2026-09-13
+**Freshly updated:** v1.3.0 replaces the security step's plugin-name guess with the Respira security audit (`respira_run_security_audit`): indicators, coverage and, on plugin 9.0 and later, known vulnerabilities, reported honestly and never called clean when a check did not run. v1.2.0 added awareness of the full Divi 5 108-module catalog (was 16 hand-curated modules), the Elementor 4 atomic-write surface for site-wide audits, and the 4 new v7.1 builders. Integrates with respira_generate_activity_report (a tool on plugin 9.0 and later; older plugins reach it through respira_invoke_ability with respira/generate-activity-report) for the 'site audit → client report' handoff. Cross-links to the new Activity Report Composer skill.
 **Category:** audit
 **Status:** beta
 **Requires:** Respira for WordPress plugin + MCP server
@@ -139,7 +152,7 @@ Categorize each plugin:
 - **active**: `active = true`, in use
 - **inactive**: `active = false`
 - **outdated**: `update_available = true`
-- **security_risk**: abandoned (>2 years no update) or known CVE
+- **security_risk**: abandoned (more than 2 years without an update) or listed in the security audit's `known_vulnerabilities` (Step 7)
 - **dead_weight**: installed, `active = false`, no evidence of use in content
 
 **Performance impact flags:**
@@ -196,18 +209,33 @@ Aggregate across sampled pages to estimate site-wide patterns.
 
 ### Step 7: Security Assessment
 
-Derive security posture from data already collected:
+Run the Respira security audit rather than guessing from plugin names. An installed security plugin says nothing about whether the site is patched.
+
+```
+Tool: respira_run_security_audit
+Input: { "deep_scan": true }
+```
+
+On plugin 9.0 and later the deep scan only reads. On older plugins it also writes and deletes one inert probe file in uploads, so leave `deep_scan` off there unless the owner agrees. Never set `probe_uploads_execution` in this skill: the WordPress Security Review skill asks for it with consent. If the tool is missing (a plugin older than 8.0.2), use the context checks below and say the security audit could not run.
 
 | Check | Source |
 |-------|--------|
+| Known vulnerabilities | `known_vulnerabilities` (plugin 9.0 and later): `status` `ok` means the match ran, and each match carries the version that fixes it |
+| Compromise indicators | `indicators`: every entry's `severity`, `summary` and the `note` in its evidence |
+| Core file integrity | the core checksum check in `checks`: files that differ from WordPress.org |
+| Administrators and credentials | the administrator and application password data in `checks`, and `coverage.recent_administrators` |
+| What was not checked | `coverage`: `executable_file_scan` (complete, partial or not_run) and the host-level items it marks false |
 | SSL/HTTPS | `respira_get_site_context` → site URL scheme |
 | WordPress version current | `respira_get_site_context` → respira_version |
 | PHP version supported | `respira_get_site_context` → php_version |
 | Debug mode disabled | `respira_get_site_context` → debug_mode |
-| Security plugin active | `respira_list_plugins` → scan for Wordfence, Sucuri, iThemes Security |
-| XML-RPC status | `respira_get_site_context` if exposed |
-| Admin username | Cannot be determined via MCP — note as "unable to verify, check manually" |
-| Login URL customized | Cannot be determined via MCP — note as "unable to verify, check manually" |
+| Security plugin installed | `respira_list_plugins` (informational; not scored) |
+| Login URL customized | Cannot be determined via MCP: note as "unable to verify, check manually" |
+
+Report it honestly:
+- Report every indicator, with its summary and note. Indicators are questions for the owner, not verdicts.
+- Never write "secure", "clean" or "no known vulnerabilities" when `coverage.executable_file_scan` is `partial` or `not_run`, when `known_vulnerabilities` is missing or its `status` is not `ok`, or when a high-severity indicator is present. Write "no problems found in what was checked" and name what was not checked.
+- Fixing is a separate, approval-gated step: hand it to the WordPress Security Review skill.
 
 ---
 
@@ -228,7 +256,7 @@ Builder Complexity (25 points):
   - 4+ builders: 3 pts
 
 Plugin Health (25 points):
-  - No security risks: 10 pts
+  - No plugin with a known vulnerability, and none abandoned: 10 pts (5 pts when the vulnerability check did not run: unknown is not clean)
   - <10% plugins outdated: 8 pts
   - <20% plugins inactive: 7 pts
 
@@ -238,9 +266,10 @@ Performance (15 points):
   - No major JS/CSS bloat: 5 pts
 
 Security (10 points):
-  - SSL active: 4 pts
-  - Security plugin active: 3 pts
-  - Debug mode off: 3 pts
+  - SSL active: 3 pts
+  - Debug mode off: 2 pts
+  - No high or medium indicators in the security audit: 3 pts
+  - Audit coverage complete (deep scan complete and the vulnerability check ran): 2 pts
 ```
 
 **Score labels:**
@@ -410,15 +439,19 @@ fetch("https://www.respira.press/api/skills/track-usage", {
 
 | Check | Status | Notes |
 |-------|--------|-------|
+| Known Vulnerabilities | [✅ none found / 🔴 n found / ⚠️ not checked] | [each match and the version that fixes it, or why the check did not run] |
+| Audit Indicators | [✅ none / ⚠️ / 🔴] | [each indicator's summary] |
+| Core Files | [✅/🔴] | [files that differ from WordPress.org] |
+| Administrators | [✅/⚠️] | [count, any created recently, application passwords] |
+| Scan Coverage | [✅ complete / ⚠️ partial / ⚠️ not run] | [what was not checked, including host cron, logs and backups] |
 | SSL/HTTPS | [✅/⚠️/🔴] | [details] |
-| Security Plugin | [✅/⚠️/🔴] | [Wordfence/Sucuri/None] |
 | PHP Version | [✅/⚠️/🔴] | [supported or EOL] |
 | WordPress Version | [✅/⚠️/🔴] | [current or outdated] |
 | Debug Mode | [✅/⚠️/🔴] | [on or off] |
-| Admin Username | ⚠️ Cannot verify via MCP — check manually |
-| Login URL | ⚠️ Cannot verify via MCP — check manually |
+| Security Plugin | ℹ️ | [installed or not; informational, not scored] |
+| Login URL | ⚠️ Cannot verify via MCP: check manually |
 
-**Risk Level:** [Low | Medium | High | Critical]
+**Risk Level:** [Low | Medium | High | Critical]. Never "Low" when a check did not run: say what was not checked.
 
 ---
 
@@ -466,8 +499,8 @@ these unused plugins: [list from report]"
 
 ### Fix Security Issues
 ```
-In Claude with Respira for WordPress: "Audit my WordPress security: check plugin versions,
-active security plugins, and PHP version support"
+In Claude with Respira for WordPress: "Run a WordPress security review: fix the known
+vulnerabilities one approved update at a time, then check the site again"
 ```
 
 ---