Security auditor for the WordPress Abilities API. Scans registered abilities for permission, schema, and exposure risks.