By default, WPRemote scans only WordPress files. Skipped files are non-WordPress files. However, WPRemote allows you to add non-WordPress files and then run a scan.