XERJ whitebox security audit

Run a security review where XERJ is the agent's second brain: index the code once, then interrogate it, never load whole files. The deliverable is a defensible coverage claim, not a vibe. Scripts referenced below live in docs/case-studies/wordpress-security-audit/sink-census/ (copy them alongside this skill to reuse in another repo).

When to use

• "Security-review this codebase / WordPress plugin / PHP app with coverage."
• "Find the dangerous calls / sinks and prove we didn't miss any."
• "Run the sink census / audit ledger."

Prerequisites (state them, then set up)

• XERJ running, ES-compatible, on http://127.0.0.1:9200 (xerj --insecure --data-dir ./data).
• pip install tree-sitter tree-sitter-php (+ the grammar for the target language).
• The target source tree on disk.

The loop (do these in order; report honestly at each step)

1. Map the dangerous functions (knowledge)

Use php_dangerous_functions.json, 275 PHP built-ins/constructs across 28 categories (command/code exec, unserialize, include loaders, file r/w/delete, SSRF, SQL drivers, XXE, callables, variable-injection, reflection, weak crypto/ random, type-juggling, …), each with vuln class + the taint-relevant argument. For another framework/language, extend this map, it is data, not code.

2. Census every call site (AST)

python3 sink_census.py <src> parses every file with tree-sitter and records