Wordpress Api Pro

WordPress REST API integration for managing posts, pages, media, and more on self-hosted WordPress sites. Use when you need to create, update, or retrieve Wo...

This skill is functionally coherent for managing WordPress sites, but before installing or running it: (1) Verify the source — 'Homepage: none' and unknown source reduces provenance confidence; prefer a skill hosted on a trusted repository. (2) Do NOT pass app passwords on the command line; instead set WP_APP_PASSWORD and related variables in a secure environment — command-line args may be visible to other users via ps. (3) If using multi-site config/sites.json, store it securely (restrict filesystem permissions) and ensure it is excluded from version control. (4) Review the scripts locally (they are included) to confirm there are no unexpected network endpoints or telemetry. (5) Ensure you grant each application password least-privilege on WordPress, and rotate/revoke them if the config is compromised. (6) Ask the publisher to fix the manifest metadata to declare the required environment variables and to update examples so they don't encourage insecure CLI password usage. If you cannot validate the publisher or secure the credentials storage, treat this skill as higher risk and consider alternative, better-audited tools.

Type: OpenClaw Skill Name: wordpress-api-pro Version: 3.3.0 The skill bundle provides a comprehensive set of tools for WordPress management but is classified as suspicious due to high-risk vulnerabilities in file and network handling. Specifically, scripts/upload_media.py and scripts/update_post.py allow reading arbitrary local files (via the --file and --content-file arguments) and fetching remote URLs without sanitization. In an agentic environment like OpenClaw, these features could be exploited via prompt injection to trick the AI agent into exfiltrating sensitive local data (such as ~/.ssh keys or environment configurations) to a remote WordPress site. While these capabilities are plausibly needed for the stated purpose, the lack of path validation and safety boundaries around filesystem access presents a significant security risk.