WordPress

• Analyzed: May 12, 2026, 3:45 AM
• Findings: 0
• Version: 1.0.2
• Hash: 7634d2bdaadfc14ef57c07b631d0a4d9c741f1cf589d053fa90c12deb98e7944
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: wordpress-api Version: 1.0.2 The WordPress skill bundle provides a standard integration for managing WordPress.com content via a proxy service (api.maton.ai). The SKILL.md file contains well-documented Python and JavaScript examples for interacting with the REST API, and it explicitly instructs the AI agent to seek user approval for all write operations. No evidence of malicious intent, data exfiltration, or harmful prompt injection was found; the code logic is consistent with the stated purpose of API integration.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

Note

What this means

Anyone using this skill is granting delegated access to WordPress.com resources through Maton.

Why it was flagged

The skill requires a Maton API key that is used to access the user's connected WordPress.com account.

Skill content

All requests require the Maton API key in the Authorization header: Authorization: Bearer $MATON_API_KEY

Recommendation

Use a trusted Maton account, keep the API key private, and revoke unused WordPress.com connections when no longer needed.

ASI02: Tool Misuse and Exploitation

Note

What this means

Misuse or mistaken use could publish, edit, or delete WordPress.com content.

Why it was flagged

The skill exposes content-management operations, including create/update/delete capabilities that can change or remove site content.

Skill content

Use this skill when users want to create, read, update, or delete WordPress.com posts, pages, or manage site content.

Recommendation

Confirm the target site, post/page ID, and intended change before any write or delete action.

ASI07: Insecure Inter-Agent Communication

Note

What this means

WordPress request data and delegated authorization flow through a third-party provider.

Why it was flagged

WordPress API traffic and OAuth handling are mediated by the Maton service rather than going directly to WordPress.com.

Skill content

Maton proxies requests to `public-api.wordpress.com` and automatically injects your OAuth token.

Recommendation

Install only if you are comfortable using Maton as the OAuth/API proxy for your WordPress.com account.