ClawHub
Back to skill

Security audit

WordPress API Auto Post 文章自动发布API

Security checks for vulnerabilities and agentic risk

Overview

This skill publishes approved SEO articles to WordPress and handles credentials in a disclosed but security-sensitive way.

Install only in a trusted workspace, use a dedicated WordPress account with the minimum post-editing permissions, keep the .env file private, verify WP_SITE_URL starts with https://, test with draft status first, and remove the WordPress snippet plus revoke the application password if you stop using the skill.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/publish_wp_article.py:25
Finding

WordPress credentials may be transmitted to an insecure or redirected endpoint

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 69)May include surrounding context.

步骤 3：配置环境变量 / Step 3: Configure Environment Variables

bash
cp .env.example .env

用你的实际信息编辑 .env / Edit .env with your actual values:

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The command export $(cat .env | grep "^WP_" | xargs) unsafely parses the .env file through the shell, which can break on spaces, quotes, or shell metacharacters and may unintentionally execute or mis-handle attacker-controlled content if the .env file is modified. In an agent or shared-workspace context, loading secrets this way increases the risk of credential disclosure or command injection via environment-file contents.

Content

Scanner excerpt · README.md (reported line 90)May include surrounding context.

Load environment variables and publish a test draft:

bash
export $(cat .env | grep "^WP_" | xargs)

python3 scripts/publish_wp_article.py '{
  "title": "Test Article — Please Delete",

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

This repeats the same unsafe shell-loading pattern for secrets from .env, which can misparse credentials containing spaces and can become dangerous if the file contents are attacker-influenced. Because the skill is intended for automation, this pattern is more risky than in a purely manual local workflow: agents may run it in shared or less-trusted environments.

Content

Scanner excerpt · README.md (reported line 144)May include surrounding context.

完整示例 / Full Example

bash
export $(cat .env | grep "^WP_" | xargs)

python3 scripts/publish_wp_article.py '{
  "title": "Top 5 Benefits of Renting Robots for Corporate Events",

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The documented command exports secrets from a local .env file into the shell environment before running the publisher. Exposing WordPress credentials as environment variables increases the chance of accidental leakage through process inspection, shell history/workflow logging, inherited subprocess environments, or downstream agent/tool misuse.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

bash
cd ~/.openclaw/workspace-marketing
export $(cat .env | grep "^WP_" | xargs)
python3 skills/wp-seo-publisher/scripts/publish_wp_article.py '<json_data>'

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 173)May include surrounding context.

md
| `seo_title` | String | 否 | 自定义 SEO 标题（留空则用 title） |
| `seo_description` | String | 否 | 自定义 meta description（留空则用 excerpt） |
| `tags` | Array | 否 | 标签名称列表（不存在的 tag 会自动创建） |
| `category_id` | Number | 否 | 分类 ID（留空则用 .env 中的默认值） |
| `status` | String | 否 | `publish` 或 `draft`（默认 `draft`） |

## RankMath 免费版自动处理的 SEO 功能

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 174)May include surrounding context.

md
| `seo_title` | String | 否 | 自定义 SEO 标题（留空则用 title） |
| `seo_description` | String | 否 | 自定义 meta description（留空则用 excerpt） |
| `tags` | Array | 否 | 标签名称列表（不存在的 tag 会自动创建） |
| `category_id` | Number | 否 | 分类 ID（留空则用 .env 中的默认值） |
| `status` | String | 否 | `publish` 或 `draft`（默认 `draft`） |

## RankMath 免费版自动处理的 SEO 功能

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
| `seo_title` | String | 否 | 自定义 SEO 标题（留空则用 title） |
| `seo_description` | String | 否 | 自定义 meta description（留空则用 excerpt） |
| `tags` | Array | 否 | 标签名称列表（不存在的 tag 会自动创建） |
| `category_id` | Number | 否 | 分类 ID（留空则用 .env 中的默认值） |
| `status` | String | 否 | `publish` 或 `draft`（默认 `draft`） |

## RankMath 免费版自动处理的 SEO 功能

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill clearly expects access to environment variables and outbound network connectivity to WordPress, but it does not declare any tool scope restrictions such as allowed tools or permissions. This creates an over-broad execution model where an agent may use more capabilities than necessary, reducing containment if the skill is misused or modified.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

This duplicate finding identifies the same risk: persistent application-password based access that survives beyond a single run. In the context of an agent skill with network publishing capability, credential persistence meaningfully increases blast radius if the execution environment is abused.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
- WP_CATEGORY_ID
credentials:
  - type: wordpress_app_password
    description: WordPress Application Password with edit_posts capability. Grants REST API access to create posts and manage tags as the configured user.
---

# WordPress SEO Publisher

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

This duplicate finding identifies the same risk: persistent application-password based access that survives beyond a single run. In the context of an agent skill with network publishing capability, credential persistence meaningfully increases blast radius if the execution environment is abused.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
- WP_CATEGORY_ID
credentials:
  - type: wordpress_app_password
    description: WordPress Application Password with edit_posts capability. Grants REST API access to create posts and manage tags as the configured user.
---

# WordPress SEO Publisher

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file's operative instructions, requirements, workflow, and warnings are presented in Chinese, which effectively forces a specific language for users and agents consuming the skill. There is no opt-in, alternate language option, or stated region-specific justification that would exempt this from the language/locale policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.