ClawHub
Back to skill

Security audit

WordPress

Security checks across malware telemetry and agentic risk

Overview

This WordPress skill is a disclosed Maton-based API integration, with broad WordPress API access that users should control carefully.

Install only if you are comfortable letting an agent call the WordPress.com API through Maton for the connected account. Confirm the exact site, connection, endpoint, payload, and effect before any post/page publication, deletion, user-setting change, or other write action, and prefer OAuth over long-lived API keys.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill advertises a relatively narrow purpose, but the documented `maton api` passthrough allows arbitrary WordPress API paths, methods, query strings, and most headers. That creates a capability mismatch: an agent invoking this skill could reach endpoints unrelated to posts/pages/content management, increasing the chance of overbroad actions, privilege misuse, or unsafe handling of unexpected API surfaces.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.