Back to skill
Skillv0.5.0
ClawScan security
WordPress WP-CLI Internal API · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 4, 2026, 8:53 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent with its stated purpose (authoring and reviewing WP-CLI command code); it is instruction-only, requests no credentials, and contains a simple local script to render command skeletons.
- Guidance
- This skill appears safe and coherent for WP-CLI command development. Before running: (1) review the small render-command-skeleton.sh script (it simply prints or writes a PHP template); (2) avoid passing a --write path that could overwrite important system files—use a dev workspace or temporary path; (3) review any generated PHP before loading it into production; (4) note that autonomous agent invocation is allowed by default—if you enable the skill for automated agents, restrict what paths and write-arguments those agents may use.
Review Dimensions
- Purpose & Capability
- okName, description, and included files (references and a skeleton generator) align with WP-CLI command authoring. There are no unrelated binaries, env vars, or network installs requested.
- Instruction Scope
- noteSKILL.md stays on-purpose (read local references, use the provided script to render command skeletons, prefer WP_CLI internal helpers). The included script can write a generated PHP file to any --write path supplied by the caller, so callers/agents should avoid passing sensitive or system paths to prevent accidental overwrites.
- Install Mechanism
- okNo install spec or external downloads — instruction-only with a local shell script. Nothing is fetched from external URLs or written to disk by an installer.
- Credentials
- okThe skill declares no environment variables, credentials, or config paths. The runtime instructions only reference bundled local files and WP-CLI internal APIs appropriate to the stated purpose.
- Persistence & Privilege
- okalways is false and the skill does not request persistent or cross-skill privileges. Autonomous invocation is allowed by default (normal for skills) but not combined with other concerning privileges.