Houtini-lm

Instructions

Implementation Reference

• src/prompts/analyze/wordpress-plugin-audit.ts:100-116 (handler)

  Main handler function that orchestrates the WordPress plugin audit execution, including validation, model setup, and chained analysis.

  async execute(params: any, llmClient: any) {
    return await withSecurity(this, params, llmClient, async (secureParams) => {
      try {
        // 1. Validate WordPress plugin structure
        this.validateWordPressPlugin(secureParams);
        
        // 2. Setup model
        const { model, contextLength } = await ModelSetup.getReadyModel(llmClient);
        
        // 3. Execute chained analysis workflow
        return await this.executeChainedAnalysis(secureParams, llmClient, model, contextLength);
        
      } catch (error: any) {
        return ErrorHandler.createExecutionError('audit_wordpress_plugin', error);
      }
    });
  }

• src/prompts/analyze/wordpress-plugin-audit.ts:131-213 (handler)

  Core chained analysis orchestrator that executes multiple sub-tools (structure, dependencies, security, etc.) and synthesizes results.

  private async executeChainedAnalysis(params: any, llmClient: any, model: any, contextLength: number) {
    const auditSteps = params.includeSteps || ['structure', 'dependencies', 'security', 'database', 'quality'];
    const results: Record<string, any> = {};
    const stepExecutionLog: string[] = [];
    
    try {
      stepExecutionLog.push(`Starting WordPress plugin audit with ${auditSteps.length} steps`);
      
      // Step 1: Project Structure Overview
      if (auditSteps.includes('structure')) {
        stepExecutionLog.push('Executing: Project structure analysis');
        results.structure = await this.runAnalysisStep('count_files', {
          projectPath: params.projectPath,
          analysisType: 'comprehensive',
          maxDepth: params.maxDepth
        }, llmClient);
        stepExecutionLog.push(`Structure analysis: ${results.structure.success ? 'SUCCESS' : 'FAILED'}`);
      }
      
      // Step 2: Dependencies Analysis  
      if (auditSteps.includes('dependencies')) {
        stepExecutionLog.push('Executing: Dependencies analysis');
        results.dependencies = await this.runAnalysisStep('analyze_dependencies', {
          projectPath: params.projectPath,
          analysisType: 'comprehensive',
          includePackageJson: true,
          checkDevDependencies: false
        }, llmClient);
        stepExecutionLog.push(`Dependencies analysis: ${results.dependencies.success ? 'SUCCESS' : 'FAILED'}`);
      }
      
      // Step 3: WordPress Security Audit
      if (auditSteps.includes('security')) {
        stepExecutionLog.push('Executing: WordPress security analysis');
        results.security = await this.runAnalysisStep('analyze_wordpress_security', {
          projectPath: params.projectPath,
          wpType: 'plugin',
          wpVersion: params.wpVersion,
          analysisType: 'comprehensive',
          includeOwaspTop10: true
        }, llmClient);
        stepExecutionLog.push(`Security analysis: ${results.security.success ? 'SUCCESS' : 'FAILED'}`);
      }
      
      // Step 4: Database Query Analysis
      if (auditSteps.includes('database')) {
        stepExecutionLog.push('Executing: Database query analysis');
        results.database = await this.runAnalysisStep('analyze_database_queries', {
          projectPath: params.projectPath,
          analysisType: 'comprehensive',
          context: { projectType: 'wordpress-plugin' }
        }, llmClient);
        stepExecutionLog.push(`Database analysis: ${results.database.success ? 'SUCCESS' : 'FAILED'}`);
      }
      
      // Step 5: Code Quality Assessment
      if (auditSteps.includes('quality')) {
        stepExecutionLog.push('Executing: Code quality analysis');
        results.quality = await this.runAnalysisStep('analyze_code_quality', {
          projectPath: params.projectPath,
          analysisType: 'comprehensive',
          language: 'php'
        }, llmClient);
        stepExecutionLog.push(`Quality analysis: ${results.quality.success ? 'SUCCESS' : 'FAILED'}`);
      }
      
      // Step 6: Synthesize all results
      stepExecutionLog.push('Synthesizing comprehensive audit report');
      const synthesizedResults = await this.synthesizeAuditResults({
        ...results,
        executionLog: stepExecutionLog,
        completedSteps: auditSteps.filter(step => results[step]?.success),
        failedSteps: auditSteps.filter(step => results[step]?.success === false)
      }, params, model, contextLength);
      
      stepExecutionLog.push('Audit synthesis: COMPLETED');
      return synthesizedResults;
      
    } catch (error: any) {
      stepExecutionLog.push(`Audit failed: ${error.message}`);
      return ErrorHandler.createExecutionError('audit_wordpress_plugin', error);
    }
  }

• src/prompts/analyze/wordpress-plugin-audit.ts:36-89 (schema)

  Input schema defining parameters for the tool, including projectPath, auditDepth, auditType, etc.

  parameters = {
    // Multi-file parameters (primary mode for plugin audit)
    projectPath: {
      type: 'string' as const,
      description: 'Path to WordPress plugin root directory',
      required: true
    },
    
    // Analysis configuration
    auditDepth: {
      type: 'string' as const,
      description: 'Depth of audit analysis',
      enum: ['basic', 'detailed', 'comprehensive'],
      default: 'comprehensive',
      required: false
    },
    auditType: {
      type: 'string' as const,
      description: 'Type of audit focus',
      enum: ['security', 'performance', 'quality', 'full-audit'],
      default: 'full-audit',
      required: false
    },
    
    // Analysis step configuration
    includeSteps: {
      type: 'array' as const,
      description: 'Analysis steps to include in audit',
      required: false,
      items: { type: 'string' as const },
      default: ['structure', 'dependencies', 'security', 'database', 'quality']
    },
    
    maxDepth: {
      type: 'number' as const,
      description: 'Maximum directory depth for analysis (1-5)',
      required: false,
      default: 4
    },
    
    // WordPress-specific context
    wpVersion: {
      type: 'string' as const,
      description: 'Target WordPress version for compatibility checks',
      required: false,
      default: '6.4'
    },
    phpVersion: {
      type: 'string' as const,
      description: 'Target PHP version for compatibility checks', 
      required: false,
      default: '8.0'
    }
  };

• src/prompts/analyze/wordpress-plugin-audit.ts:30-33 (registration)

  Plugin class definition and registration with tool name 'audit_wordpress_plugin' and description.

  export class WordPressPluginAuditor extends BasePlugin implements IPromptPlugin {
    name = 'audit_wordpress_plugin';
    category = 'analyze' as const;
    description = 'Comprehensive WordPress plugin audit - chains multiple analysis steps for security, performance, dependencies, and code quality';

• src/prompts/analyze/wordpress-plugin-audit.ts:332-477 (helper)

  Helper method generating the multi-stage prompt for synthesizing audit results into a comprehensive report.

    private getMultiFilePromptStages(params: any): PromptStages {
      const { analysisResult, auditType, auditDepth, wpVersion, phpVersion, stepCount } = params;
      
      const systemAndContext = `You are a senior WordPress plugin security and performance expert with 15+ years of experience auditing enterprise WordPress installations.
  
  **AUDIT CONTEXT:**
  - Audit Type: ${auditType}
  - Audit Depth: ${auditDepth}
  - Analysis Steps Completed: ${stepCount}
  - Target WordPress Version: ${wpVersion}
  - Target PHP Version: ${phpVersion}
  - Plugin Type: WordPress Plugin
  
  **YOUR EXPERTISE:**
  You are internationally recognized for:
  - WordPress plugin security auditing and penetration testing
  - Performance optimization for high-traffic WordPress sites
  - Code quality assessment for WordPress.org repository submissions
  - Database optimization and query performance analysis
  - Dependency management and conflict resolution
  
  **AUDIT METHODOLOGY:**
  1. **Security Assessment**: OWASP Top 10, WordPress-specific vulnerabilities
  2. **Performance Analysis**: Database queries, caching, resource usage
  3. **Code Quality Review**: WordPress Coding Standards, best practices
  4. **Dependency Analysis**: Plugin conflicts, version compatibility
  5. **Architecture Review**: Plugin structure, hooks usage, extensibility
  
  **CRITICAL FOCUS AREAS:**
  - SQL injection vulnerabilities in custom queries
  - XSS vulnerabilities in admin interfaces and frontend output
  - CSRF protection through nonces validation
  - Capability and permission checks
  - Data sanitization and validation
  - Performance bottlenecks in database queries
  - Unused code and dependencies
  - WordPress API compliance and best practices`;
  
      const dataPayload = `**COMPREHENSIVE AUDIT RESULTS:**
  
  ${JSON.stringify(analysisResult, null, 2)}`;
  
      const outputInstructions = `**PROVIDE COMPREHENSIVE WORDPRESS PLUGIN AUDIT REPORT:**
  
  {
    "executiveSummary": {
      "overallRating": "critical|high-risk|medium-risk|low-risk|excellent",
      "primaryConcerns": ["concern1", "concern2", "concern3"],
      "strengths": ["strength1", "strength2"],
      "recommendedActions": ["action1", "action2"],
      "timeToFix": "immediate|1-2 days|1 week|2+ weeks"
    },
    
    "securityAssessment": {
      "criticalVulnerabilities": [
        {
          "type": "SQL Injection|XSS|CSRF|Authentication Bypass",
          "severity": "critical|high|medium|low",
          "location": "specific file and line",
          "description": "detailed vulnerability description",
          "exploit": "how this could be exploited",
          "fix": "specific fix with code example"
        }
      ],
      "securityScore": "A|B|C|D|F",
      "complianceIssues": ["OWASP issue 1", "WordPress security issue 2"]
    },
    
    "performanceAssessment": {
      "databaseIssues": [
        {
          "type": "N+1 Query|Missing Index|Inefficient Query|Direct SQL",
          "severity": "critical|high|medium|low",
          "location": "file and function",
          "impact": "performance impact description",
          "optimization": "specific optimization recommendation"
        }
      ],
      "performanceScore": "A|B|C|D|F",
      "bottlenecks": ["bottleneck1", "bottleneck2"],
      "optimizations": ["optimization1", "optimization2"]
    },
    
    "codeQualityAssessment": {
      "wordpressStandards": {
        "compliance": "high|medium|low",
        "violations": ["violation1", "violation2"],
        "score": "A|B|C|D|F"
      },
      "maintainability": {
        "score": "high|medium|low",
        "issues": ["issue1", "issue2"],
        "improvements": ["improvement1", "improvement2"]
      }
    },
    
    "dependencyAssessment": {
      "unusedCode": ["unused file 1", "unused function 2"],
      "conflicts": ["potential conflict 1"],
      "outdatedDependencies": ["dependency1", "dependency2"],
      "recommendations": ["remove unused X", "update Y to version Z"]
    },
    
    "actionPlan": {
      "immediate": [
        {
          "priority": 1,
          "task": "fix critical security vulnerability",
          "estimatedTime": "2 hours",
          "risk": "critical"
        }
      ],
      "shortTerm": [
        {
          "priority": 2,
          "task": "optimize database queries",
          "estimatedTime": "4 hours",
          "risk": "medium"
        }
      ],
      "longTerm": [
        {
          "priority": 3,
          "task": "refactor architecture",
          "estimatedTime": "2 days",
          "risk": "low"
        }
      ]
    },
    
    "complianceReport": {
      "wordpressOrgReady": true,
      "issuesBlocking": ["issue1", "issue2"],
      "recommendationsForSubmission": ["recommendation1", "recommendation2"]
    }
  }
  
  **REQUIREMENTS:**
  - Provide specific file names and line numbers for all issues
  - Include code examples for fixes where applicable
  - Prioritize findings by business impact and security risk
  - Ensure all recommendations are actionable and testable
  - Focus on WordPress-specific best practices and security guidelines`;
  
      return { systemAndContext, dataPayload, outputInstructions };
    }