WordPress Expert

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:52 PM UTC
• Version: 1.0.12

Overview

This is a coherent WordPress-management skill, but its recommended companion plugin install pulls unpinned external code before granting powerful WordPress access.

Install only after reviewing the companion plugin source and dependencies, preferably from a pinned commit or release. Start on staging, use a dedicated least-privilege WordPress application-password user, allow only the specific tools you need, and avoid enabling WP-CLI, media upload, or plugin-file writes on production unless you have backups and clear rollback steps.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:21
• Finding: Unpinned Remote Companion Plugin Installation## Vulnerability Details **File Location**: `README.md:21-27` **Vulnerability Type**: Unpinned remote code retrieval and dependency installation **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/realM1lF/openclaw-wordpress-tool.git cd openclaw-wordpress-tool && npm install openclaw plugins install -l "$(pwd)" openclaw plugins enable wordpress-site-tools openclaw gateway restart ``` The same installation workflow is also recommended in `SKILL.md:17-30` and `references/CONNECTING.md:58-69`. ### Technical Analysis The documented procedure clones the mutable default branch of a personal GitHub repository and immediately runs `npm install`. It does not pin an immutable commit or release, verify a checksum or signature, or otherwise establish that the fetched source matches a reviewed version. Running `npm install` may execute package lifecycle scripts and install mutable transitive dependencies. The resulting code is then installed and enabled as an OpenClaw gateway plugin. The plugin itself is not included in this audit artifact, so its implementation, dependency lock state, lifecycle scripts, and security controls could not be verified. This external component is expected to receive powerful capabilities, including authenticated WordPress REST access, WP-CLI invocation, media upload, and plugin-file access. Remote installation is necessary only if the optional companion plugin is chosen; using an unpinned source is not necessary for the declared WordPress-management functionality. ### Attack Path 1. An attacker compromises the GitHub repository, its maintainer account, or one of its npm dependencies. 2. The attacker inserts malicious code into the default branch or dependency resolution path. 3. A user follows the documented commands and clones the changed repository. 4. `npm install` executes malicious package code or lifecycle scripts on the OpenClaw gateway host. 5. The user install ...[truncated 778 chars]
• Remediation: ## Remediation Suggestions 1. Pin installation instructions to a reviewed release and immutable commit hash rather than the repository's default branch. 2. Publish and verify cryptographic checksums or signed release artifacts before installation. 3. Include and enforce a reviewed dependency lockfile; use `npm ci` instead of unconstrained `npm install`. 4. Audit package lifecycle scripts and consider `npm ci --ignore-scripts` if the plugin does not require install scripts. 5. Vendor the reviewed plugin into a signed release or distribute it through a controlled, verifiable registry. 6. Install and test the plugin in an isolated staging environment before granting production access. 7. Initially allow only the minimum required tools, such as connection checking and narrowly scoped REST access. Do not grant the plugin-wide shorthand allowlist by default. 8. Use a dedicated, least-privilege WordPress application-password user and avoid production administrator credentials. 9. Enable WP-CLI and plugin-file tools only when necessary, with narrowly constrained profiles and filesystem paths.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/BLOCK_EDITOR.md:15
• Finding: Unpinned Package Execution Through npx## Vulnerability Details **File Location**: `references/BLOCK_EDITOR.md:15-19` **Vulnerability Type**: Unpinned package retrieval and execution **Risk Level**: Medium ### Vulnerable Code ```bash npx @wordpress/create-block my-namespace-my-block --namespace my-plugin ``` ### Technical Analysis The instruction invokes `npx` without an exact package version. If the package is not already installed and pinned locally, `npx` can retrieve and execute the currently resolved registry version. This makes the effective executable mutable after the Skill has been reviewed. The package is relevant to the declared block-development functionality and is not inherently malicious. The weakness is the absence of version pinning, lockfile enforcement, and integrity verification. A compromised package release, registry account, or dependency could execute code in the host or CI context where the command is run. ### Attack Path 1. An attacker compromises the package publication account, registry resolution path, or a transitive dependency. 2. A malicious or compromised version becomes the version resolved by the unpinned package reference. 3. A user or agent follows the scaffolding instruction on a development host or CI runner. 4. `npx` downloads and executes the compromised package. 5. The package performs actions with the privileges and accessible credentials of that host process. ### Impact Assessment Exploitation could result in arbitrary code execution under the invoking user's account. Accessible source code, environment variables, repository credentials, CI secrets, and writable project files could be exposed or modified. The artifact recommends running this on a host or CI environment rather than assuming npm exists on production, which reduces but does not eliminate the risk.
• Remediation: ## Remediation Suggestions 1. Specify an approved exact version, for example `npx --yes @wordpress/create-block@<reviewed-version> ...`. 2. Prefer adding the package at an exact version to a development dependency and committing the resulting lockfile. 3. Install with `npm ci` and invoke the locked local executable through a package script. 4. Review package integrity metadata and dependency changes before upgrading. 5. Execute scaffolding in an isolated development container or restricted CI job without production credentials. 6. Do not run the command on a production WordPress server.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. **HTTPS**
2. User with appropriate role
3. **Application password:** Users → Profile → Application Passwords → create and store securely (not the login password)
4. **Test REST:** browser `https://your-domain.tld/wp-json/` (subdirectory: `https://domain.tld/blog/wp-json/`)
5. Check security/firewall plugins if REST is blocked

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Do not change as side effects unless explicitly requested: `blogname`, `blogdescription`, `show_on_front`, `page_on_front`, `page_for_posts`, `permalink_structure`, `default_role`, `users_can_register`, `template`, `stylesheet`.

For WP-CLI: no bulk `option update` without confirmation.

## Injection

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

- **Shop / builder:** Woo, Elementor, etc. **as far as REST or documented automation** goes; else browser or clear manual steps.
- **Tools:** Broader **profiled** WP-CLI allowlists or additional safe tools; REST coverage where useful; small **MU plugin** only for gaps (health, capabilities), not as a substitute for proper APIs.

### As developer (write plugins & extend third parties)

- **New plugins:** Scaffold (structure, `readme.txt`, main file, hooks), **PHP** per WordPress coding standards, **i18n**, **activation/deactivation**, custom REST routes only with permission checks.
- **Extend third-party plugins:** Only via **official/supported** means: `add_action` / `add_filter`, small **bridge** or **addon** plugins on documented hooks (Woo, ACF, etc.—project-specific in references).

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The natural-language content in the changelog uses German exclusively ('aufgeräumt', 'Nutzerorientierter Leitfaden') with no indication that the skill or its documentation is intentionally region-specific. This can violate a language/locale policy when a specific language is imposed without user choice or documented justification.

Static analysis

No suspicious patterns detected.