July 9, 2026
Last month I cleaned up a WordPress site that had been reinfected three times. The previous contractor kept missing a self-healing backdoor — a base64 payload sitting in wp_options with a cron job that rebuilt it every six hours. After I fixed it, I wrote the whole process down: every command, every place to look, every hardening step after.
That became a skill. A self-contained runbook that any AI agent — or any developer using Claude Code — can load and follow.
Today I'm making it available for $5 USDC. No account. No checkout page. No Stripe. Just an HTTP request.
What "buying with USDC" actually means
There's a protocol called x402 — it's HTTP 402 Payment Required, but made useful. When an AI agent requests a protected resource, the server returns a 402 with payment requirements embedded in the response. The agent pays on Base (Coinbase's L2) using a signed permit — no gas required on the buyer's side — and retries the request with a payment receipt. The server verifies the receipt with Coinbase's facilitator and serves the content.
The whole flow takes one round trip. No redirects, no OAuth, no webhook. It's how the web should have always handled small payments.
The skills I shipped
Five runbooks from real client work:
WordPress Malware Incident Response — $5 USDC
Full IR runbook: containment, forensic snapshot, finding self-healing backdoors (mu-plugins, wp_options payloads, malicious cron jobs), eradication, hardening, and Google Safe Browsing recovery. Built from a real engagement where the site had 115+ injected spam posts and a backdoor that survived two previous cleanup attempts.
DNS Migration Without Downtime — $3 USDC Nameserver and Cloudflare migrations that don't silently break client email. MX/SPF/DKIM/DMARC inventory before cutover, TTL staging, verification checklist, and rollback plan. The thing most guides skip is auditing email auth records before you touch DNS — this one doesn't.
Client Website Handoff — $2 USDC Clean project closeout: deliverables package, ownership-first credential transfer, content-update docs, deployment and SSL notes, sign-off checklist, and a maintenance retainer offer template. The $2 price is intentional — this should be free knowledge, but the x402 gate keeps agents from hammering it.
Pre-Registered Backtest Gate — $5 USDC A methodology for testing trading strategies without fooling yourself. Commit to a success bar — in writing, before the data exists — run once, honor the result. The discipline that stops you deploying a strategy that looked good in backtests and loses money live. Six phases: pre-registration, run, decision tree, exploratory vs confirmatory, forward validation, ledger.
Federal GS-2210 STAR Application — $3 USDC IT Security federal job application runbook: resume formatting for USAJobs, HR specialist screen strategy, and five STAR interview stories from real engagements (malware IR, Linux service fleet, look-ahead bias bug, SPF/DKIM client communication, SQLi risk triage). Built for GS-9/11 Security and Sysadmin specialty tracks.
How to use them
In Claude Code — install the full bundle:
/plugin marketplace add thewizrdz/wizrdz-skills
Single skill via x402 — any agent that speaks HTTP 402 can buy one:
GET https://wizrdz-skills-gate.thewizrdz.workers.dev/skills/wordpress-malware-incident-response/SKILL.md
The server returns a 402 with USDC payment requirements. Pay, retry, get the file.
Browse the source: github.com/Thewzrdz/wizrdz-skills
The stats endpoint
Every successful purchase increments a counter. You can see live sales at:
https://wizrdz-skills-gate.thewizrdz.workers.dev/stats
Right now it reads zero. That's fine — every product starts there.
These are the runbooks I actually use. If you've ever had to explain SPF records to a client at 11pm, or watched a site get reinfected three days after you cleaned it, these are for you.