Security audit
Security checks across malware telemetry and agentic risk
This is a transparent social-posting skill, but it gives an agent standing ability to publish publicly from logged-in accounts and WordPress without enough approval and credential-safety guardrails.
Install only if you are comfortable letting the agent publish from your logged-in social accounts and configured WordPress site. Before use, inspect the external image script, protect the WordPress env file with restrictive permissions, use a least-privilege application password, know how to revoke it, and require the agent to show the exact text, image paths, target accounts, and destination URLs before each final post or publish action.
WordPress uses REST API with Application Password — no browser needed. Create a credentials file at `~/.openclaw/.wp-[yoursite].env`: ```bash WP_URL=https://yoursite.com
62/62 vendors flagged this skill as clean.
No suspicious patterns detected.
