Skill

Interactive guide to deploy a production-ready WordPress site for international trade businesses. Triggers on "build a trade website", "deploy wordpress trad...

This skill appears to do what it says (deploy a WordPress site) but it will execute privileged operations on any server you give it access to — treat such access as highly sensitive. Before using it: - Only provide SSH access to a server you control and are willing to let the agent provision. Prefer creating a sudo-enabled non-root account rather than giving root credentials. - Review the template repository (https://github.com/iPythoning/wordpress-trade-starter) and any Docker Compose files before starting; these will run services as root and may expose ports and volumes. - Be cautious about running remote install scripts (curl https://get.docker.com | sh). If you prefer, install Docker yourself or review the script prior to execution. - The verification SSH command disables StrictHostKeyChecking — avoid using that in hostile networks; confirm host keys yourself to prevent MITM. - If the skill automates DNS/Cloudflare changes (the README hints at Cloudflare integration), check whether it asks for API tokens in later phases; only provide tokens with the minimum required scope. - Save and rotate any generated DB passwords and store them in a secure vault. Back up data before major changes. If you want the agent to perform deployments automatically, monitor the first run closely and review every prompt. If you prefer manual control, run the steps the skill suggests yourself after reviewing them.

Type: OpenClaw Skill Name: wordpress-trade-site Version: 1.2.0 The skill requests full SSH root credentials and executes complex shell commands to deploy a WordPress environment. It downloads and executes remote code from a GitHub repository (iPythoning/wordpress-trade-starter) and appends remote PHP scripts to the WordPress theme (geo-functions.php). While these actions support the stated deployment goal, the process lacks input sanitization for user-provided variables (e.g., DOMAIN, EMAIL), creating a high risk of command injection. Furthermore, instructions in SKILL.md for the agent to 'automate everything' and 'diagnose and fix errors proactively' grant the AI broad, potentially dangerous autonomy over the user's server without sufficient guardrails.