← Back to Skills Marketplace
116
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install wordpress-security-scanner
Description
Scan WordPress sites for security vulnerabilities, misconfigurations, and potential threats.
Usage Guidance
This skill appears to be a thin wrapper around a third-party WordPress scanning API but omits critical operational details (server URL in the OpenAPI, authentication, and how billing is handled). Before installing or invoking it: 1) Verify the publisher and reputation of the external API (toolweb.in / api.mkkpro.com). 2) Confirm whether an API key or account is required and whether the skill will prompt you to supply credentials—do not provide secrets unless you trust the provider. 3) Understand data flow: scans will involve sending target URLs (and possibly response data) to an external service—do not send internal/private site URLs or credentials. 4) Ensure you have permission to scan any target site (unauthorized scanning can be illegal). 5) Prefer skills that declare required env vars or servers clearly; ask the author to add explicit server/auth info and privacy/billing details before use. If you cannot verify the external API or publisher, avoid installing or use only in a controlled, non-production test environment.
Capability Analysis
Type: OpenClaw Skill
Name: wordpress-security-scanner
Version: 1.0.0
The WordPress Security Scanner skill bundle is a standard API wrapper for a remote security assessment service. It contains no executable code, only metadata and documentation (SKILL.md, openapi.json) that define how an AI agent should interact with an external API hosted at api.mkkpro.com. No indicators of malicious intent, data exfiltration, or prompt injection were identified.
Capability Assessment
Purpose & Capability
The SKILL.md advertises an automated WordPress scanner and lists external endpoints (toolweb.in, api.mkkpro.com) and pricing, but the skill contains no implementation code and the openapi.json has no server URL or auth scheme. It is unclear how the agent will perform scans (local logic vs. remote API) and no credentials or billing hooks are declared despite the pricing/options in the documentation.
Instruction Scope
Instructions are narrowly scoped to a POST /scan request and example request/response shapes. They do not instruct reading local files or other system state, but they also do not specify which host to call or whether/how to authenticate. The SKILL.md references external API docs and routes, which implies outbound network calls to third-party services.
Install Mechanism
No install spec and no code files to execute are included (instruction-only), so nothing will be written to disk by an installer. This minimizes local install risk, but runtime network calls remain possible.
Credentials
The skill declares no required environment variables or primary credential, yet its documentation and external endpoints suggest a third-party API that is likely gated by API keys or billing. The absence of declared auth or required secrets is an inconsistency — if an API key is needed the skill should declare it; if not, the docs should explain how unauthenticated use is allowed.
Persistence & Privilege
always is false and the skill is user-invocable with normal autonomous invocation allowed. This is the platform default and appropriate for this kind of skill. The skill does not request permanent presence or modification of other skills.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install wordpress-security-scanner - After installation, invoke the skill by name or use
/wordpress-security-scanner - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of WordPress Security Scanner.
- Scan WordPress sites for vulnerabilities, misconfigurations, and threats.
- Detects outdated versions, exposed version info, missing security headers, and more.
- Provides categorized severity levels and remediation guidance for each finding.
- Includes a /scan endpoint accepting any public WordPress URL.
- Offers tiered pricing from free to enterprise plans.
Metadata
Frequently Asked Questions
What is WordPress Security Scanner?
Scan WordPress sites for security vulnerabilities, misconfigurations, and potential threats. It is an AI Agent Skill for Claude Code / OpenClaw, with 116 downloads so far.
How do I install WordPress Security Scanner?
Run "/install wordpress-security-scanner" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is WordPress Security Scanner free?
Yes, WordPress Security Scanner is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does WordPress Security Scanner support?
WordPress Security Scanner is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created WordPress Security Scanner?
It is built and maintained by ToolWeb (@krishnakumarmahadevan-cmd); the current version is v1.0.0.
More Skills