Security checks across malware telemetry and agentic risk
This appears to be a legitimate WordPress publishing helper, but it needs review because it can use site credentials to publish content and upload local files with limited guardrails.
Install only if you want an agent to manage a WordPress site. Use a least-privilege application password, prefer staging and draft-by-default workflows, require explicit approval before publishing, deleting, or uploading media, avoid admin credentials and inline secrets, do not use verify=False or verbose authenticated logging with real credentials, and restrict media uploads to reviewed files or a small reviewed folder.
```python
def publish_post(post_id):
"""Publish a draft post."""
response = requests.post(f"{wp_url}/wp-json/wp/v2/posts/{post_id}",
json={"status": "publish"}, auth=auth)
return response.json()
```## Example Request ```bash # Using curl with Application Password curl -X POST https://your-site.com/wp-json/wp/v2/posts \ -u "admin:xxxx xxxx xxxx xxxx xxxx xxxx" \ -H "Content-Type: application/json" \
66/66 vendors flagged this skill as clean.