Pinch to Post - Manage WordPress sites through WP Pinch MCP server

• Outcome: Pass
• Latest audit: May 27, 2026, 9:04 PM
• Version:
  5.5.1

Overview

This skill is a clearly disclosed WordPress management integration, but it should only be installed for sites where you intend the agent to have scoped administrative access.

Install this only for WordPress sites you are comfortable managing from an agent, configure the MCP server with the least-privileged WordPress Application Password or OpenClaw Agent role, keep write budgets/read-only mode enabled where possible, review WP Pinch audit logs, and be aware that broad triggers like "post" or "blog" may make the skill available in more conversations than strictly necessary.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad terms like "post" and "blog," which can cause the skill to activate in conversations that are not clearly intended to manage a WordPress site. Because this skill exposes high-impact site management actions through MCP tools, accidental invocation increases the chance of unintended administrative operations or disclosure of site data.

VirusTotal

63/63 vendors flagged this skill as clean.