Security audit
Security checks for vulnerabilities and agentic risk
This skill can make real WordPress site changes and store an app password, but those capabilities are disclosed, purpose-aligned, and gated by user direction.
Install only for a WordPress site you intend Codex to edit. Use a least-privileged WordPress application password, avoid running it against production unless you have backups and approval, leave the default pinned plugin version unless you independently verify another release, and revoke the application password and deactivate/remove the MCP authoring plugin after handoff.
Referenced artifact was not completely inspected
**Shell / setup actions run only on explicit user confirmation.** The bundled `setup-elementor-mcp.sh` (which shells out, runs Local's WP-CLI, downloads the pl
The skill explicitly directs use of .mcp.json and environment variables containing WP_URL, WP_USERNAME, and a reusable WP_APP_PASSWORD, and earlier metadata states .mcp.json embeds Basic-Auth credentials. That creates a real secret-handling risk: credentials may be written to disk in project directories, exposed to other tools in the session, or accidentally committed or disclosed if directory boundaries are misunderstood.
> **Engine:** this skill drives our fork `Digitizers/elementor-mcp` (v1.34.1, the release this kit's installer pins; Elementor 4.x-correct), a single self-contained plugin — no Freemius, no phone-home. Since fork v1.28.0 it carries its own update checker, which **offers** later GitHub Releases on the site's normal Updates screens (release-only, a user agent naming only the plugin); installing one is WordPress's ordinary update flow, and the fork does not switch on WordPress's per-plugin auto-update. **Never run it alongside the paid "MCP Tools for Elementor (Premium)" — same class names → fatal.** Details + switch commands → `references/engine-and-premium.md`.
If the user has a WordPress site but no **working** `elementor` MCP connection — either no `.mcp.json` at all, or only this kit's committed placeholder config (values like `"WP_URL": "${WP_URL:-}"` with those env vars unset) and no `mcp__elementor__elementor-mcp-*` tools loaded:
> In the placeholder case there are two fixes, not one: **export `WP_URL` / `WP_USERNAME` / `WP_APP_PASSWORD`** (the committed config reads them — fastest in this repo's checkout or a cloud session), or run the wizard below from a **separate per-site project directory** (it refuses to write credentials into the tracked placeholder file).
Referenced artifact was not completely inspected
APP_PASSWORD` env vars, or `config/sites.json` for multi-site. See that repo's `SKILL.md`.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
1. `create-popup` → returns a `post_id`; build the popup content into it with
native widgets like any page.
2. Set trigger + display rules via the popup's settings (load `get-widget-schema`
/ the popup settings schema to confirm keys).
3. Wire an open action where needed (e.g. a Button's link set to the popup), or
let the trigger fire it automatically.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
print(p["plugin"]); break
' "$slug" 2>/dev/null)
if [ -n "$plugin_path" ]; then
site_curl -s -u "$WP_USER:$WP_APP_PWD" --max-time 30 \
-H "Content-Type: application/json" \
-X POST "$SITE_URL/wp-json/wp/v2/plugins/$plugin_path" \
-d '{"status":"active"}' >/dev/null
The script downloads a plugin release from GitHub and installs it as active PHP code on a WordPress site. Although it has stronger-than-average defenses with HTTPS, a pinned default version, and SHA-256 verification, any workflow that fetches and installs externally hosted code expands supply-chain risk, especially when overrides like EMCP_PIN_VERSION=latest rely on release-published digests rather than an out-of-band trusted value.
EM_EXPECTED=$(printf '%s\n' "$EM_PLAN" | sed -n 2p)
EM_LABEL=$(printf '%s\n' "$EM_PLAN" | sed -n 3p)
info "Downloading the elementor-mcp fork — $EM_LABEL (bundles the MCP Adapter; trusted Digitizers repo, HTTPS)..."
EM_RELEASE_JSON=$(curl -s "$EM_RELEASE_API")
EM_ZIPBALL=$(printf '%s' "$EM_RELEASE_JSON" \
| python3 -c "$JQ_LENIENT_PY"'
import sys
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
if [ -n "$EM_DIR" ] && [ "$(basename "$EM_DIR")" != "elementor-mcp" ]; then
mv "$EM_DIR" "$WORK/elementor-mcp"
fi
( cd "$WORK" && rm -f elementor-mcp.zip && zip -qr elementor-mcp.zip elementor-mcp )
ok "Repacked elementor-mcp.zip with clean folder name"
MANUAL_UPLOAD="no"
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
else
fail "MCP namespace still missing after retry."
info "Writing .mcp.json anyway so you can debug from there."
info "Run this to see what's wrong: curl -u USER:PASS ${SITE_URL}/wp-json/"
fi
fi
fi
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
What would you like to do with your Elementor site?
1. Build — create new pages or sections from a design
2. Edit — change something on an existing page
3. Reference — inspect current state (pages, colors, fonts, content)
4. Explore — show me what's possible / what can the MCP do here
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
2. `create-page({title, status: "publish", template: "elementor_canvas"})` — Canvas template removes theme header/footer chrome so your design is the only thing on the page
3. (Via WP-CLI) Set as static front page: `wp option update show_on_front page; wp option update page_on_front <id>`
4. Build sections — **use the matching recipe from the Recipe library** (outer container → inner boxed container, max-width ~1360px → content), bound to brand tokens
5. After each section: `get-page-structure(post_id)` to verify nesting, or just curl the front page
6. **Pause for human review** before building header/footer (which use Header Footer Elementor templates, a different flow)
## When the user asks to EDIT
The script persists a reusable WordPress Basic Auth credential in a local .mcp.json file so later MCP sessions can authenticate automatically. Even with mode 600 and git-ignore protections, storing long-lived credentials on disk increases the blast radius of workstation compromise, backup leakage, or accidental sharing of the project directory.
#!/usr/bin/env bash
# =============================================================================
# setup-elementor-mcp.sh — Wire up the Elementor MCP server against a
# WordPress site (Local-by-Flywheel or live host) and write a .mcp.json
# in the current directory so Claude Code can drive Elementor.
#
# Usage: bash "<skill-dir>/setup-elementor-mcp.sh"
The header says the script 'confirms Elementor + Hello Elementor are installed (warns if not)', which describes a read/check-only behavior for those dependencies. In reality, the code later installs and activates plugins and installs a theme via WordPress REST endpoints, which is a materially different and site-modifying action.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# afterwards destroys the user's existing config on any failure.
#
# Windows is a separate path on purpose. Git Bash on NTFS does not implement
# POSIX mode bits - `chmod 600` can report success while `ls -l` still shows
# -rw-r--r-- - so verifying the mode there would reject every write and make
# the wizard unusable on a platform this kit documents as supported. icacls is
# the mechanism that actually restricts the file on that platform.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# afterwards destroys the user's existing config on any failure.
#
# Windows is a separate path on purpose. Git Bash on NTFS does not implement
# POSIX mode bits - `chmod 600` can report success while `ls -l` still shows
# -rw-r--r-- - so verifying the mode there would reject every write and make
# the wizard unusable on a platform this kit documents as supported. icacls is
# the mechanism that actually restricts the file on that platform.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# caller names the override, nothing is chosen silently.
emcp_release_plan(){
pin="${1:-}"; want="${2:-}"; have="${3:-}"
api="https://api.github.com/repos/Digitizers/elementor-mcp/releases"
case "$pin" in
"")
if [ -n "$have" ] && ver_lt "${EMCP_DEFAULT_VERSION#v}" "$have"; then return 2; fi
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(p["plugin"]); break
' "$slug" 2>/dev/null)
if [ -n "$plugin_path" ]; then
site_curl -s -u "$WP_USER:$WP_APP_PWD" --max-time 30 \
-H "Content-Type: application/json" \
-X POST "$SITE_URL/wp-json/wp/v2/plugins/$plugin_path" \
-d '{"status":"active"}' >/dev/null
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(p["plugin"]); break
' "$slug" 2>/dev/null)
if [ -n "$plugin_path" ]; then
site_curl -s -u "$WP_USER:$WP_APP_PWD" --max-time 30 \
-H "Content-Type: application/json" \
-X POST "$SITE_URL/wp-json/wp/v2/plugins/$plugin_path" \
-d '{"status":"active"}' >/dev/null
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if [ "$(plugin_is_active "$slug")" = "yes" ]; then
info "Deactivating $label..."
site_curl -s -u "$WP_USER:$WP_APP_PWD" --max-time 30 \
-H "Content-Type: application/json" \
-X PUT "$SITE_URL/wp-json/wp/v2/plugins/$plugin_path" \
-d '{"status":"inactive"}' >/dev/null
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
if remove_plugin "mcp-adapter" "MCP Adapter (standalone)"; then
ok "Old standalone MCP Adapter removed — safe to install the bundled fork."
else
warn "Could not automatically remove the standalone 'MCP Adapter' plugin."
cat <<EOF
Installing the bundled fork on top of the old adapter would leave TWO
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
if [ "${SKIP_WRITE:-0}" != "1" ]; then
# Create it 0600 BEFORE the credential lands in it: writing first and chmod-ing
# after leaves a window where the file is world-readable on a shared machine.
# Written through a 0600 temp file and renamed into place, so the credential
# is never in a readable file and an existing config survives any failure.
write_secret_file "$MCP_FILE" "$NEW_CONFIG"
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# several lines and pasting it into the JSON above yields an invalid config.
# tr -d is portable; -w0 is GNU-only.
info " printf '%s:%s' '${WP_USER}' \"\$(read -rs -p 'app password: ' p; echo \"\$p\")\" | base64 | tr -d '\\n'; echo"
warn "SECURITY: that config embeds a reusable WordPress credential — write it"
info " with mode 600, keep it out of version control, and rotate/revoke the"
info " Application Password after use."
fi
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
${BOLD}${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}
${BOLD}Reference:${RESET}
Skill file: ~/.claude/skills/siteagent-elementor-studio/SKILL.md
MCP plugin: https://github.com/Digitizers/elementor-mcp
EOF
Immediately above the prompt, the script instructs the user to confirm activation of a single plugin: 'MCP Tools for Elementor'. The wording 'both are active' contradicts the actual recovery context and could mislead the operator about what components are expected.
No suspicious patterns detected.