wp-audit-standards

WP Audit Standards

This skill defines the audit criteria, severity levels, report format, and quality thresholds used by all wp-audit agents.

---

Severity Levels

Severity	Meaning	Action
CRITICAL	Security vulnerability, complete accessibility failure, broken core functionality	Fix immediately
WARNING	Best-practice violation, degraded UX, performance issue	Fix before delivery
INFO	Optimization opportunity, minor improvement	Fix when convenient

---

Report JSON Schema

All audit agents MUST output findings in this format:

{
  "category": "security|seo|a11y|performance|best-practices",
  "tier": 1,
  "issues": [
    {
      "severity": "critical|warning|info",
      "code": "SEC-001",
      "message": "Human-readable description",
      "file": "path/to/file.php",
      "line": 42,
      "auto_fixable": true,
      "fix_method": "Description of how to fix"
    }
  ],
  "summary": {
    "total": 0,
    "critical": 0,
    "warning": 0,
    "info": 0,
    "auto_fixable": 0
  }
}

Field Requirements

• category — one of: security, seo, a11y, performance, best-practices
• tier — integer 1–3 indicating which audit tier produced the finding
• issues — array of issue objects (may be empty)
• severity — one of: critical, warning, info
• code — prefixed issue code (see Issue Code Prefixes below)
• message — human-readable description of the problem
• file — relative path to the affected file
• line — line number (0 if not applicable)
• auto_fixable — boolean indicating whether the agent can safely fix this
• fix_method — description of the fix approach
• summary — counts aggregated from the issues array

---

Issue Code Prefixes

Prefix	Domain
SEC-xxx	Security
SEO-xxx	SEO
A11Y-xxx	Accessibility
PERF-xxx	Performance
WP-xxx	Best Practices

---

Audit Tiers

Tier 1 — Code-only (always available)