Scan a WordPress backup for malware, backdoors, and known vulnerabilities
Scan the WordPress backup at the path provided by the user: $ARGUMENTS
If no path was provided, ask the user for the path to the WordPress backup directory.
python3 ~/.claude/skills/wp-incident-scan/wp-incident-prescan.py "$ARGUMENTS"
The prescan prints the path to wp-prescan-results.json on stdout. Read that file and extract _meta.output_dir — this is where all scan output will be written. Use this as {output_root} when reading prompts. The backup path ($ARGUMENTS) remains {backup_root}.
The scan instructions are split into per-phase files under prompts/. Read them sequentially:
Each agent should read its corresponding per-section JSON file from the prescan-data/ directory rather than receiving raw JSON in its prompt.