Automated WordPress blog publishing with scheduling

This package mostly does what it says — it posts article JSON to a WordPress site using Basic auth and writes local logs on failure. Before installing consider: 1) The SKILL.md mentions additional files (formatter.py, scheduler.py) and dependencies that are missing; ask the author for the complete bundle or updated docs. 2) Provide WP credentials only for sites you control or staging instances; app passwords grant post privileges and should be scoped and rotated. 3) The script uses HTTP Basic (base64) headers — ensure you call an HTTPS WP_URL to protect credentials in transit. 4) The tool reads arbitrary article file paths and writes logs/failed HTML locally — avoid pointing it at sensitive directories and review log handling so tokens are not accidentally recorded. 5) If you need scheduling or media upload, verify those features exist in the full package (they are referenced in docs but not implemented in index.py). If the maintainer cannot explain the missing files or supply a complete, reviewed package, treat this skill as incomplete and avoid running it with real credentials.

Type: OpenClaw Skill Name: blog-automation Version: 1.0.1 The skill is classified as suspicious due to critical vulnerabilities related to file system access. The `index.py` script directly reads the `ARTICLE_JSON` file path and writes to a `log` file path, both provided as command-line arguments, without any input sanitization. This creates a significant risk of Local File Inclusion (LFI) and Arbitrary File Write, allowing an attacker to potentially read arbitrary files (e.g., credentials, system files) or write to arbitrary locations on the agent's host system if they can control these input paths (e.g., via prompt injection against the OpenClaw agent). While the skill's stated purpose is benign, these vulnerabilities could be exploited for data exfiltration or system compromise.