Wopdpress AI Blogger

Create, edit, and publish WordPress posts via REST API with full Gutenberg block support. Use when Codex needs to automate WordPress content publishing, gene...

This package appears to do what it says (create Gutenberg posts, upload media, manage categories/tags), but exercise caution before using it with real credentials or a production site. Key points to consider: - Registry metadata does not advertise the environment variables the scripts need (WP_URL, WP_USERNAME, WP_APPLICATION_PASSWORD). Treat that omission as a red flag: verify required variables and where they are stored before use. - Prefer creating a low-privilege WordPress account (capabilities: edit_posts, but not full admin) or use a scoped Application Password for the site instead of an admin password. - Review the included Python scripts locally before running. They perform filesystem reads (uploads) and network requests to the specified WP_URL; ensure you won't accidentally upload sensitive local files. - Avoid following the troubleshooting advice to disable SSL verification in production (verify=False) or to log full HTTP requests in environments where credentials or sensitive content might be recorded. - Test on a staging site first. Confirm behavior (what gets uploaded, what fields are set) and monitor server logs for unexpected activity. If you want higher confidence, ask the author/source for corrected registry metadata listing required env vars, or request a minimal example run showing only a safe demo against a known test site.

Type: OpenClaw Skill Name: wordpress-api-gutenberg Version: 1.0.0 The skill bundle is designed for legitimate WordPress REST API interactions. However, the Python scripts `scripts/media_uploader.py` and `scripts/wp_publish.py` exhibit a local file inclusion/disclosure vulnerability. Both scripts accept file paths for media uploads (via command-line arguments, CSV files, or JSON configuration). If an attacker can control these input paths, they could specify arbitrary sensitive local files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`). The scripts would then attempt to read these files and upload their content to the configured WordPress site, leading to unintended data disclosure. This is a significant vulnerability, not evidence of intentional malicious behavior by the skill author.