Wordpress OAuth

Start and complete WordPress.com OAuth and publish posts through the WordPress.com REST API. Use when you need to generate an authorization URL, exchange cal...

This skill appears to do what it claims: run an OAuth flow against WordPress.com and publish posts. Before installing or using it, consider: 1) The skill will create oauth_state.json and credentials.json in the skill directory containing sensitive tokens and client secrets—keep that directory private and back up/remove credentials when no longer needed. 2) Supply client_id/secret/redirect/site via CLI flags or secure shell environment variables (examples use shell expansion). 3) The script attempts to set restrictive file permissions but may not succeed on all OSes—verify the files are not world-readable. 4) Review the full Python file (the repository includes the code) yourself if you need higher assurance (the provided snippet is consistent, but the file was truncated in the listing). 5) If you plan to allow autonomous agent invocation, be aware the agent could call publish-post using stored credentials—limit that capability if you don't want unattended publishing.

Type: OpenClaw Skill Name: wordpress-oauth Version: 1.0.0 The wordpress-oauth skill implements a standard OAuth 2.0 flow and post-publishing functionality for WordPress.com. The Python script (wp_oauth_skill.py) follows security best practices by using the secrets module for CSRF state generation, validating state during token exchange, and enforcing restrictive file permissions (0o600) on the local credentials store. All network activity is directed to official WordPress API endpoints, and there is no evidence of data exfiltration or malicious execution.