Security audit

Blog with Wordpress

Security checks for vulnerabilities and agentic risk

Overview

This WordPress publishing skill does what it claims, but it gives an agent live publishing power with weak safety boundaries around credentials, confirmation, and endpoint validation.

Review carefully before installing. Only use this with a dedicated low-privilege WordPress application password, require HTTPS and a known host, prefer draft-first publishing with explicit confirmation, and avoid sourcing a shared .env file as shell code.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:44
Finding: Workspace Environment File Is Executed as Shell Code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:46
Finding: WordPress Credentials Can Be Transmitted Over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:156
Finding: User-Controlled Values Are Interpolated Directly into JSON Requests
Content: View full analysis
In this comprehensive benchmark analysis..." # Convert markdown to HTML SLUG="ryzen-7950x-vs-i9-13900k-benchmark-comparison" EXCERPT="We compare two flagship processors across gaming, productivity, and power efficiency." # Create post POST_RESULT=$(curl -s -X POST "${WP_URL}/wp-json/wp/v2/posts" \ -u "${WP_USER}:${WP_PASS}" \ -H "Content-Type: application/json" \ -d "{ \"title\": \"${TITLE}\", \"content\": \"${CONTENT}\", \"slug\": \"${SLUG}\", \"status\": \"publish\", \"categories\": [${CAT_ID}], \"tags\": [${TAG_IDS}], \"excerpt\": \"${EXCERPT}\" }") ``` Category and tag requests use the same unsafe construction: ```bash -d "{\"name\": \"${CATEGORY_NAME}\"}") ``` ```bash -d "{\"name\": \"${TAG}\"}") ``` The documented escaping operation is incomplete and is not applied to the post request: ```bash # Escape quotes for JSON ESCAPED_CONTENT=$(echo "$CONTENT" | sed 's/"/\\"/g') ``` ### Technical Analysis The Skill manually constructs JSON by inserting title, content, slug, excerpt, category, and tag values into quoted JSON strings. These values can originate from user-provided article material or generated metadata. JSON strings require correct encoding of quotation marks, backslashes, control characters, and line breaks. Replacing only quotation marks is not sufficient, and the resulting `ESCAPED_CONTENT` variable is not used by the demonstrated post commands in any event. A crafted value containing quotation marks and JSON delimiters can terminate its intended string and alter the surrounding payload. Depending on the injected value and the WordPress JSON parser's handling of duplicate fields, an attacker may add o ...[truncated 1456 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
Read credentials from workspace .env:

bash
# Load credentials from .env file source /root/.openclaw/workspace/.env WP_URL="${WP_BLOG_URL:-https://blog.example.com}"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
Read credentials from workspace .env:

bash
# Load credentials from .env file source /root/.openclaw/workspace/.env WP_URL="${WP_BLOG_URL:-https://blog.example.com}"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
Read credentials from workspace .env:

bash
# Load credentials from .env file source /root/.openclaw/workspace/.env WP_URL="${WP_BLOG_URL:-https://blog.example.com}"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 258)May include surrounding context.
Read credentials from workspace .env:

bash
# Load credentials from .env file source /root/.openclaw/workspace/.env WP_URL="${WP_BLOG_URL:-https://blog.example.com}"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The description does not clearly warn that the skill performs authenticated writes to a live external service, including publishing posts and modifying taxonomy. Users may believe they are only formatting content or drafting, when the skill can make irreversible or publicly visible changes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger guidance is broad enough to activate on generic discussion about blogging or article creation, which can route ordinary user conversation into a skill that performs authenticated, state-changing publication actions. In this context, over-triggering is dangerous because the skill can create categories, tags, and publish posts to a live WordPress site with little friction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description explicitly states 'SEO-friendly English slug generation,' which imposes a language choice by default. The file does not offer the user a language/locale choice or explain a justified region-specific requirement, so this is a natural-language locale policy issue.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: This code transmits authenticated data to an external WordPress endpoint to create categories. In a skill that may auto-trigger and lacks strong confirmation boundaries, external transmission is security-relevant because it causes real state changes on a third-party system using workspace credentials.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
# Create if not exists if [ -z "$CAT_ID" ]; then CAT_RESULT=$(curl -s -X POST "${WP_URL}/wp-json/wp/v2/categories" \ -u "${WP_USER}:${WP_PASS}" \ -H "Content-Type: application/json" \ -d "{\"name\": \"${CATEGORY_NAME}\"}")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: This request creates tags on the remote WordPress site, which is an authenticated mutation of external state. Because tags are derived from content and may be auto-generated, the skill can silently modify site taxonomy in ways the user did not explicitly approve.
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
md
# Create if not exists if [ -z "$TID" ]; then TAG_RESULT=$(curl -s -X POST "${WP_URL}/wp-json/wp/v2/tags" \ -u "${WP_USER}:${WP_PASS}" \ -H "Content-Type: application/json" \ -d "{\"name\": \"${TAG}\"}")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 98% confidence
Finding: This is the primary external transmission that publishes content to a live WordPress site using stored credentials. In context, the danger is elevated because the skill can push arbitrary user-provided or model-generated content directly to production, potentially causing defacement, misinformation, or accidental public disclosure.
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
md
EXCERPT="We compare two flagship processors across gaming, productivity, and power efficiency." # Create post POST_RESULT=$(curl -s -X POST "${WP_URL}/wp-json/wp/v2/posts" \ -u "${WP_USER}:${WP_PASS}" \ -H "Content-Type: application/json" \ -d "{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: Updating an existing post via authenticated API call can alter live or draft content and metadata on a production blog. Without strict user confirmation and target validation, this can unintentionally overwrite or tamper with legitimate content.
Content: Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.
bash
POST_ID="123" # Existing post ID UPDATE_RESULT=$(curl -s -X POST "${WP_URL}/wp-json/wp/v2/posts/${POST_ID}" \ -u "${WP_USER}:${WP_PASS}" \ -H "Content-Type: application/json" \ -d "{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The workflow example includes an external authenticated category-creation request, demonstrating a repeatable path for live site modification. Even as sample code, it operationalizes state-changing behavior that a user may execute without understanding the consequences.
Content: Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.
md
CONTENT="<p>The battle for desktop CPU supremacy continues...</p><h2>Test Methodology</h2><p>All tests were conducted on identical platforms...</p>" # Step 1: Create/Get Category CAT_RESULT=$(curl -s -X POST "${WP_URL}/wp-json/wp/v2/categories" \ -u "${WP_USER}:${WP_PASS}" \ -H "Content-Type: application/json" \ -d "{\"name\": \"${CATEGORY}\"}")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This example sends authenticated tag-creation requests to the blog, modifying external taxonomy. The security concern is the same as above: easy-to-run sample code increases the chance of unintended writes to a live site.
Content: Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.
md
# Step 2: Create/Get Tags TAG_IDS="" for TAG in "${TAGS[@]}"; do TAG_RESULT=$(curl -s -X POST "${WP_URL}/wp-json/wp/v2/tags" \ -u "${WP_USER}:${WP_PASS}" \ -H "Content-Type: application/json" \ -d "{\"name\": \"${TAG}\"}")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: This example performs authenticated post creation with publish status, causing immediate public content publication on an external service. In a skill context, publishing is the core function, but it is still dangerous when not guarded by explicit consent, draft-first behavior, and robust validation.
Content: Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.
md
TAG_IDS=$(echo "$TAG_IDS" | sed 's/^,//') # Step 3: Create Post POST_RESULT=$(curl -s -X POST "${WP_URL}/wp-json/wp/v2/posts" \ -u "${WP_USER}:${WP_PASS}" \ -H "Content-Type: application/json" \ -d "{

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The safety rules say to 'Always generate English slug for SEO-friendly URLs,' which is a blanket language requirement. No opt-in, fallback, or locale-specific justification is provided, so the instruction violates the policy against forcing a language choice.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: SKILL.md:48