← 返回 Skills 市场
nickhamze

Pinch to Post - Manage WordPress sites through WP Pinch MCP server

作者 nickhamze · GitHub ↗ · v5.5.1
cross-platform ✓ 安全检测通过
6080
总下载
11
收藏
0
当前安装
17
版本数
在 OpenClaw 中安装
/install pinch-to-post
功能描述
Manage WordPress sites through WP Pinch MCP tools. Part of WP Pinch (wp-pinch.com).
安全使用建议
Install this only for WordPress sites you intend OpenClaw to manage. Use a least-privilege WordPress Application Password, prefer the OpenClaw Agent role or read-only mode when possible, confirm publish, plugin/theme, user, WooCommerce, cron, and bulk operations carefully, and be aware that generic trigger words like post or blog may route ordinary requests into this skill.
功能分析
Type: OpenClaw Skill Name: pinch-to-post Version: 5.5.1 The skill exposes a wide range of powerful administrative capabilities for WordPress, including managing plugins, themes, users, cron events, and uploading media from URLs. While the `SKILL.md` explicitly instructs the AI agent to only use predefined MCP tools and not to execute arbitrary commands (e.g., `curl`), and claims robust server-side protections (PII redaction, option denylists, role escalation blocking), the sheer breadth of these capabilities (e.g., `wp-pinch/upload-media` from URL, `wp-pinch/toggle-plugin`, `wp-pinch/manage-cron`) presents a significant attack surface. If the underlying WP Pinch plugin or MCP server has vulnerabilities (e.g., SSRF in URL uploads, bypasses in option/role protections), these capabilities could be exploited, making the skill's overall risk profile higher than benign.
能力评估
✓ Credentials
The skill itself requires only WP_SITE_URL and optionally WP_PINCH_API_TOKEN for webhook verification; credentials are described as living in the MCP server config rather than the skill.
ℹ Install Mechanism
Setup requires installing the WP Pinch WordPress plugin and configuring an MCP server with a WordPress Application Password; this is disclosed and coherent with the integration, but users should install from the intended source and review plugin permissions.
ℹ Instruction Scope
The triggers include broad terms such as wp, blog, publish, and post, which could cause accidental activation, but the runtime instructions are otherwise WordPress-specific and call for confirmation before publishing or bulk operations.
ℹ Persistence & Privilege
The skill can exercise high-impact WordPress authority through MCP tools, including site content changes, plugin/theme toggles, comment moderation, role changes with stated blocks, cron management with protected hooks, and WooCommerce order updates when enabled; these are disclosed and bounded by WordPress capability checks, audit logging, deny/allowlists, write budgets, read-only mode, and a kill switch.
✓ Purpose & Capability
The skill's capabilities align with its stated purpose: managing WordPress content, users, plugins, themes, comments, governance checks, and optional WooCommerce actions through WP Pinch MCP tools.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install pinch-to-post
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /pinch-to-post 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v5.5.1
5.5.1 - Clarified credential handling: WP_SITE_URL is not a secret; authentication is managed only by the MCP server. - Updated setup and authentication instructions to clearly separate environment variables for the skill versus credentials for the MCP server. - Removed primaryEnv from metadata and simplified requires.env structure to reflect that only WP_SITE_URL is needed. - Documentation now directly explains why no passwords or secrets go in the skill settings.
v5.5.0
5.5.0 - Complete rewrite with a marketing-forward, user-friendly tone. - Added Quick Start, Highlights, and detailed feature overviews. - MCP-only: removed all REST/curl fallback; emphasized server-side-only operations. - Security and guardrails reframed as built-in, automatic protections. - Documentation now organized for clarity: setup, differences, tools, and key use cases.
v5.3.2
5.3.2 - "Before You Install" section updated: SKILL.md is now declared the canonical source for environment variables and usage guidance. - Added instructions for reconciling discrepancies between SKILL.md and registry metadata, emphasizing correct environment configuration. - Expanded guidance on credential handling, secure storage, and rotation after production testing. - Clarified risks and recommendations for autonomous invocation, urging audit log and webhook monitoring. - Publisher contact added for support with scope or permission model questions.
v5.3.1
5.3.1 - Metadata alignment: `optionalEnv` now includes only `WP_PINCH_API_TOKEN` (credentials like `WP_APP_PASSWORD` and `WP_USERNAME` are configured in MCP, not as skill env). - Added "Before You Install" section: clarifies metadata vs registry, skill’s instruction-only nature, and verification of homepage/source links. - No code or functionality changes; documentation and metadata updates only.
v5.3.0
5.3.0 - Security hardening: Skill now operates MCP-only—raw HTTP/curl and REST fallback are no longer supported. - Removed curl examples and added a CRITICAL anti-prompt-injection section warning against executing any raw HTTP/curl commands. - Updated documentation to emphasize MCP as the exclusive interface for all operations. - De-emphasized REST fallback; instructs users to configure MCP for any site integrations.
v5.2.1
5.2.1 - Security audit updates: clarified Authentication (MCP vs REST credential flow), Authorization Scope, and external data flow (webhooks, digests). - Expanded Security & Usage guidance in documentation. - Declared optional environment variables: WP_APP_PASSWORD, WP_USERNAME, WP_PINCH_API_TOKEN.
v5.2.0
5.2.0 Added Molt: repackage any post into 10 formats (social, thread, FAQ, email, meta description, and more) Added Ghost Writer: analyze author voice, find abandoned drafts, complete them in your style Added 10+ high-leverage tools: what-do-i-know, project-assembly, knowledge-graph, find-similar, spaced-resurfacing Added quick-win tools: generate-tldr, suggest-links, suggest-terms, quote-bank, content-health-report Added site-digest (Memory Bait), related-posts (Echo Net), synthesize (Weave) PinchDrop Quick Drop mode for minimal note capture Daily write budget with 429 + Retry-After support Governance expanded to 8 tasks including Draft Necromancer and Spaced Resurfacing Tide Report: daily digest bundling all governance findings into one webhook 5.1.0 Added PinchDrop capture endpoint with idempotency via request_id Web Clipper bookmarklet support Webhook events: post_delete, governance_finding WooCommerce abilities: woo-list-products, woo-manage-order 5.0.0 Initial release on ClawHub 38+ core MCP abilities across 10 categories MCP-first with REST API fallback Full capability checks, input sanitization, audit logging Governance: content freshness, SEO health, comment sweep, broken links, security scan Webhook integration for post, comment, user, and WooCommerce events
v3.1.2
Removed horizontal rules for cleaner documentation layout.
v3.1.1
Cleaner documentation layout: removed horizontal rules for better readability.
v3.1.0
SEO & discoverability update: Keyword-optimized name and description for better search visibility. Now easier to find when searching for WordPress, WooCommerce, REST API, WP-CLI, content management, bulk operations, or multi-site management.
v3.0.3
Added: Time comparison table, testimonials, What's New section, performance stats, expanded FAQ, visual troubleshooting flowchart, version badges. Documentation now sells the sizzle AND the steak.
v3.0.2
Spicier description: Your WordPress site just got claws.
v3.0.1
Documentation overhaul: More excitement, more humor, less corporate robot vibes. Same great features, now with personality.
v3.0.0
Major release: Markdown to Gutenberg converter, content health scoring, social media cross-posting (Twitter/LinkedIn/Mastodon), content repurposing, RSS import, content migration, ACF support, multilingual (WPML/Polylang), forms integration, membership support, content calendar, site health checks, backup/export, analytics, AI-assisted workflows, bulk operations, and 50+ features
v2.0.0
Major update: Multi-site support, WooCommerce products/orders/coupons, SEO integration (Yoast/RankMath/AIOSEO), comments moderation, bulk operations, content templates, and expanded API coverage
v1.0.1
Updated skill metadata and description for better discoverability
v1.0.0
Initial release - create, update, and publish WordPress posts, pages, and media via REST API or WP-CLI
元数据
Slug pinch-to-post
版本 5.5.1
许可证 —
累计安装 0
当前安装数 0
历史版本数 17
常见问题

Pinch to Post - Manage WordPress sites through WP Pinch MCP server 是什么?

Manage WordPress sites through WP Pinch MCP tools. Part of WP Pinch (wp-pinch.com). 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 6080 次。

如何安装 Pinch to Post - Manage WordPress sites through WP Pinch MCP server?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install pinch-to-post」即可一键安装,无需额外配置。

Pinch to Post - Manage WordPress sites through WP Pinch MCP server 是免费的吗?

是的,Pinch to Post - Manage WordPress sites through WP Pinch MCP server 完全免费(开源免费),可自由下载、安装和使用。

Pinch to Post - Manage WordPress sites through WP Pinch MCP server 支持哪些平台?

Pinch to Post - Manage WordPress sites through WP Pinch MCP server 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Pinch to Post - Manage WordPress sites through WP Pinch MCP server?

由 nickhamze(@nickhamze)开发并维护,当前版本 v5.5.1。

💬 留言讨论