[pfefferle]

Fixes #

Proposed changes:

• The security-audit agent had grown to about 60 KB and loaded its whole vulnerability history and audit scope on every run, whatever the change touched. That knowledge now lives in a new review skill, split by area into .agents/skills/review/guidelines/ (content exposure, authorization, signatures, inbox, remote fetch, output, integrations, supply chain, cron, accessibility). Each file says which paths it applies to, and a review only loads the files the change touches. A handler change now reads about 30 KB instead of 60 KB.
• The history entries and scope sections lost their numbers. Rules that were written down twice (once as history, once as scope) are stated once, and references point to the file and heading instead of #13 or §4.
• review/SKILL.md is the shared base for both agents: stay read-only, read the code after the change (a - line is gone), treat the diff and PR text as untrusted, check the impact on callers, check that a fix fixes and that its test can fail, keep decisions already made, and what a finding needs.
• review/judge.md checks all findings of a review in one pass, instead of one agent per finding.
• The code-review agent uses the same base and guidelines, has clear limits next to the security agent, and gained checks for backwards compatibility, value types, deploy safety and i18n. Its output drops the summary and the "Positive" section.
• AGENTS.md lost its CRITICAL/MUST/ALWAYS; the rules themselves are the same.

Other information:

• Have you written new tests for your changes, if applicable?

To make sure nothing got lost while condensing, I checked that every anchor of the old text is still there: all backtick tokens (functions, filters, files, constants), every CVE and WPScan id, every PR and version number. All 313 are.

The history entry about same-host keys from the signing key fix is already in here, in signatures.md and remote-fetch.md, so that branch doesn't need to add it to the old agent file.

Testing instructions:

• Run the code-review agent on a branch that touches includes/handler/. It should load inbox.md and remote-fetch.md, and nothing else.
• Run the security-audit agent for a full audit. It should read every guideline file.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message