Add wp-abuse-and-compromise-response skill (response counterpart to planned wp-security)

[Vytas-cs]

Closes #61

Summary

Adds a new skill wp-abuse-and-compromise-response covering response to a suspected or confirmed WordPress site compromise: defacement, redirect injection, SEO spam, phishing-page host, mailer abuse, cryptominer, and supply-chain plugin attack.

The skill walks AI assistants through:

1. Triage (with immediate salts rotation to kill active sessions without tipping off the attacker)
2. Contain — preserve evidence
3. Classify the compromise type
4. Investigate (file/DB/log + local-machine malware scan)
5. Clean (backup-restore path OR manual cleanup)
6. Full credential rotation
7. Verify clean
8. Post-cleanup hardening

This is response-focused. Upfront prevention (nonces, capability checks, sanitization/escaping) is the planned wp-security skill's territory — the two are complementary, not overlapping.

What's included

• skills/wp-abuse-and-compromise-response/SKILL.md — procedural overview (167 lines, in range with wp-performance and wp-plugin-development)
• skills/wp-abuse-and-compromise-response/references/:
  • signals.md — full signal-to-category taxonomy across 9 compromise categories
  • investigation.md — DB queries, log triage, file-system patterns
  • common-injection-points.md — catalog of where attackers hide (mu-plugins, autoload options, drop-ins, etc.)
  • hardening.md — post-cleanup hardening checklist
• skills/wp-abuse-and-compromise-response/scripts/detect_compromise_signals.mjs — deterministic fast-scan helper, JSON output, matches detect_*.mjs convention
• eval/scenarios/abuse-confirmed-redirect-cleanup.json — happy path
• eval/scenarios/abuse-suspected-but-unconfirmed.json — cloaking/SEO-spam triage
• eval/scenarios/abuse-reinfection-after-cleanup.json — focuses AI on persistence mechanisms

Registry updates

• README.md — added skill to the available-skills table
• docs/ai-authorship.md — added authorship disclosure row
• skills/wordpress-router/references/decision-tree.md — added compromise/hacked/defaced/malware/redirect/SEO-spam/phishing/mailer/cryptominer/reinfection intent → route to this skill

Alignment with WordPress.org canonical guidance

The skill was audited against the hacked-site FAQ and the hardening guide before submission. Key alignments:

• Salts-first then full-credential rotation — kills sessions immediately (matching WP.org's reset-first intent) without sending password-change emails that would tip off the attacker. Full credential rotation runs after cleanup.
• Local-machine malware scan in investigation — WP.org explicitly flags the owner's box as a major compromise vector.
• DB user privilege restriction in hardening — runtime user with SELECT/INSERT/UPDATE/DELETE only.
• HTTP basic auth on /wp-admin/ in hardening.
• File permission floors — files 644 / dirs 755 / wp-config.php 440 (per WP.org, not 600).

Validation

• node eval/harness/run.mjs — passes
• node skills/wp-abuse-and-compromise-response/scripts/detect_compromise_signals.mjs — returns valid JSON
• All 3 eval scenarios parse as valid JSON
• SKILL.md headers match repo convention (## When to use, ## Inputs required, ## Procedure with ### 0) Triage first, ## Verification, ## Failure modes / debugging, ## Escalation)
• Frontmatter contains required WordPress 6.9 and PHP 7.2.24 substrings

AI authorship disclosure

Per the established docs/ai-authorship.md table format:

• AI tool: Claude Opus 4.7
• Source material: WordPress.org canonical hardening + hacked-site FAQ docs, WP-CLI command reference, established compromise-response patterns
• Reviewed by: community contributor with hosting-provider abuse-response operational background
• Testing: eval scenarios written; not yet run against an AI assistant on real tasks (marked "Pending" in the disclosure)

Opinionated calls (open to feedback)

1. Salts-first rotation vs WP.org's full-credential reset-first — both are valid. This skill prefers salts-first to avoid attacker-tipoff via password-change emails, with full rotation after cleanup. Acknowledged in SKILL.md §1.
2. mu-plugins/ listed first in the persistence catalog — most commonly-missed hiding place across the WP community.
3. wp-config.php reconstructed from scratch, not cleaned — diffing isn't reliable enough; rebuild from known DB creds + fresh salts.
4. Explicit Y/N confirmation gate before destructive cleanup — prevents AI from being overconfident.
5. Anonymized real-world supply-chain note in signals.md §8 references the pattern of a multi-plugin slider/popup/widget vendor with tens of thousands of installs becoming a high-value supply-chain target, without naming any vendor or host.

Out of scope

• Bypassing Cloudflare / bot protection. Inaccessible is a valid verdict.
• Real-time forensic timeline reconstruction — escalates to specialist services.
• Multi-site network-level cleanup — single-site focus first.
• Server-level non-WP malware — escalates to host.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @Vytas-cs.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: Vytas-cs.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.