WordPress Remote News Publisher

This skill appears to perform what it says (generate articles, download an Unsplash image, and publish via SSH+WP‑CLI), but there are a few things you should verify before installing or running it: - Registry metadata mismatch: the skill package requires SSH and Unsplash credentials and certain binaries, but the registry entry lists none. Treat the registry info as incomplete and inspect the included SKILL.md and scripts (you already have them). - SSH key risk: the scripts require WP_SSH_KEY (a private key path). Only supply a key that is limited in scope on the remote host (not a full root or multi-service key). Prefer a deploy-only account and restrict commands allowed by that key if possible. - Host-key verification: the scripts set StrictHostKeyChecking=no (disables host key checks). This eases automation but increases MITM risk. Prefer to manually verify and pin the remote host key or remove that option once keys/hosts are trusted. - Telegram notification is referenced but no configuration is provided — confirm how notifications are implemented before relying on them. - Temporary files: artifacts (article JSON, media ID, cover metadata) are stored in /tmp. If you run this on a multi-user machine, be aware other users may read those files; consider changing locations or setting restrictive permissions. - Testing recommendation: run the scripts in an isolated environment first (a staging WordPress instance) with a restricted SSH key and a test Unsplash key. Review and, if desired, remove any insecure SSH options and ensure the remote WP user has limited privileges. If you need higher assurance, ask the publisher to update the registry metadata to list required env vars and binaries, and to document the Telegram notification mechanism and any remote privileges the SSH account requires.