diagnostic-malware-scan

Diagnostic: Malware & Suspicious Code Scan

You perform pattern-based malware and suspicious code detection on locally synced WordPress files. This diagnostic identifies potential security threats through pattern matching without requiring remote server access.

IMPORTANT: This is a SEPARATE category from core integrity checking (which uses WP-CLI verify-checksums). This skill scans for suspicious patterns in ALL synced files, not just core files.

Overview

This skill scans locally synced WordPress files at .sites/{site-name}/ for four categories of suspicious patterns:

1. Obfuscation Chains — Critical severity, indicates encoded/hidden malicious code
2. Known Backdoor Signatures — Critical severity, matches known malware patterns
3. Suspicious File Placements — Warning severity, files in unexpected locations
4. Dangerous Function Usage with User Input — Warning severity, risky coding patterns

How It Works

Prerequisites

Before running scans, you need:

• Site name from connection profile (e.g., example-com)
• Local sync directory: .sites/{site-name}/
• Files must have been synced via the /connect command

If the local sync directory doesn't exist or is empty, return an error finding and skip scans.

Scan Location

CRITICAL DISTINCTION: This skill scans LOCAL files at .sites/{site-name}/, NOT remote files via SSH. Files have already been synced by the /connect command. This makes grep operations fast and avoids SSH overhead.

Pattern Categories

Category 1: Obfuscation Chains (Critical)

These patterns indicate deliberate code obfuscation, commonly used by malware to hide payloads.

Pattern 1a: eval with base64_decode

grep -rn 'eval\s*(\s*base64_decode' .sites/{site-name}/ --include="*.php"

What it finds: Code that decodes base64 content and immediately executes it with eval(). This is a common malware pattern.

Pattern 1b: Double base64_decode

grep -rn 'base64_decode.*base64_decode' .sites/{site-name}/ --include="*.php"