← Back to Skills Marketplace
Skill
by
iPythoning
· GitHub ↗
· v1.2.0
· MIT-0
163
Downloads
0
Stars
0
Active Installs
4
Versions
Install in OpenClaw
/install wordpress-trade-site
Description
Interactive guide to deploy a production-ready WordPress site for international trade businesses. Triggers on "build a trade website", "deploy wordpress trad...
Usage Guidance
This skill appears to do what it says (deploy a WordPress site) but it will execute privileged operations on any server you give it access to — treat such access as highly sensitive. Before using it:
- Only provide SSH access to a server you control and are willing to let the agent provision. Prefer creating a sudo-enabled non-root account rather than giving root credentials.
- Review the template repository (https://github.com/iPythoning/wordpress-trade-starter) and any Docker Compose files before starting; these will run services as root and may expose ports and volumes.
- Be cautious about running remote install scripts (curl https://get.docker.com | sh). If you prefer, install Docker yourself or review the script prior to execution.
- The verification SSH command disables StrictHostKeyChecking — avoid using that in hostile networks; confirm host keys yourself to prevent MITM.
- If the skill automates DNS/Cloudflare changes (the README hints at Cloudflare integration), check whether it asks for API tokens in later phases; only provide tokens with the minimum required scope.
- Save and rotate any generated DB passwords and store them in a secure vault. Back up data before major changes.
If you want the agent to perform deployments automatically, monitor the first run closely and review every prompt. If you prefer manual control, run the steps the skill suggests yourself after reviewing them.
Capability Analysis
Type: OpenClaw Skill
Name: wordpress-trade-site
Version: 1.2.0
The skill requests full SSH root credentials and executes complex shell commands to deploy a WordPress environment. It downloads and executes remote code from a GitHub repository (iPythoning/wordpress-trade-starter) and appends remote PHP scripts to the WordPress theme (geo-functions.php). While these actions support the stated deployment goal, the process lacks input sanitization for user-provided variables (e.g., DOMAIN, EMAIL), creating a high risk of command injection. Furthermore, instructions in SKILL.md for the agent to 'automate everything' and 'diagnose and fix errors proactively' grant the AI broad, potentially dangerous autonomy over the user's server without sufficient guardrails.
Capability Assessment
Purpose & Capability
The name/description (deploy a production WordPress site) matches the instructions: collecting business info, gathering SSH credentials, preparing a Linux server, installing Docker, cloning the project template, writing .env, and starting containers. No unrelated credentials or capabilities are requested in the metadata.
Instruction Scope
Instructions direct the agent to perform privileged operations on the user's server (apt upgrade, install packages, enable firewall, create swap, install Docker via remote script, run docker compose, configure Nginx, manage SSL, etc.). These actions are expected for server provisioning, but the skill also disables SSH host-key checking in its verification command (ssh -o StrictHostKeyChecking=no) which weakens SSH security and could facilitate man-in-the-middle risk if used without care. The skill collects SSH credentials and sensitive secrets (DB passwords) from the user — appropriate for the task, but high-sensitivity.
Install Mechanism
The skill itself has no install spec (instruction-only), which is low risk for the agent host. However, the runtime instructions tell the agent (or the user) to run curl | sh against https://get.docker.com on the target server and to clone a GitHub repo and run its containers. Those are common deployment steps but carry risk because they execute remote code on the user's server; users should review the remote install script and repository before running.
Credentials
The skill does not declare or request any platform credentials in metadata. It asks interactively for SSH access, domain, email, and generates DB passwords — all reasonable and proportional to deploying WordPress. It does not request unrelated secrets or cloud provider API keys in the provided content. (Note: later phases mentioning Cloudflare/automation may require API tokens if the skill automates DNS changes; the truncated portion should be checked for any explicit requests for API tokens.)
Persistence & Privilege
always is false and there is no install-side persistence. The skill can be invoked by the agent (default), and it will interactively request credentials to act on a target server. Autonomous invocation combined with the need for privileged server credentials increases blast radius if the agent is allowed to act without explicit user approval, but that is the platform default and the skill appears to prompt the user for each phase.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install wordpress-trade-site - After installation, invoke the skill by name or use
/wordpress-trade-site - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.2.0
GEO v2: tiered AI bots, sameAs schema, auto llms.txt, citability guide, Bytespider block
v1.1.0
Add Flamingo plugin for CF7 form storage, GEO optimization, CF7 email recipient validation
v1.0.1
Localize all content to English for international audience
v1.0.0
Initial release: Interactive step-by-step WordPress deployment guide for international trade businesses.
- Guides users through 9 deployment phases: business info, server setup, Dockerization, SSL, WordPress installation, and plugin/theme configuration.
- Automates all possible technical steps; pauses only for essential user input or decisions.
- Collects and confirms all required business, server, and contact details interactively.
- Provides tailored server purchase and SSL setup advice based on user’s target markets.
- Reuses collected data across steps, confirms each stage, and offers troubleshooting on errors.
Metadata
Frequently Asked Questions
What is Skill?
Interactive guide to deploy a production-ready WordPress site for international trade businesses. Triggers on "build a trade website", "deploy wordpress trad... It is an AI Agent Skill for Claude Code / OpenClaw, with 163 downloads so far.
How do I install Skill?
Run "/install wordpress-trade-site" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Skill free?
Yes, Skill is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Skill support?
Skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Skill?
It is built and maintained by iPythoning (@ipythoning); the current version is v1.2.0.
More Skills