WordPress Expert

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:52 PM UTC
• Version: 1.0.12

Overview

This is a coherent WordPress-management skill, but its recommended companion plugin install pulls unpinned external code before granting powerful WordPress access.

Install only after reviewing the companion plugin source and dependencies, preferably from a pinned commit or release. Start on staging, use a dedicated least-privilege WordPress application-password user, allow only the specific tools you need, and avoid enabling WP-CLI, media upload, or plugin-file writes on production unless you have backups and clear rollback steps.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:21

Finding

Unpinned Remote Companion Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:21-27
Vulnerability Type: Unpinned remote code retrieval and dependency installation
Risk Level: High

Vulnerable Code

bash

git clone https://github.com/realM1lF/openclaw-wordpress-tool.git
cd openclaw-wordpress-tool && npm install
openclaw plugins install -l "$(pwd)"
openclaw plugins enable wordpress-site-tools
openclaw gateway restart

The same installation workflow is also recommended in SKILL.md:17-30 and references/CONNECTING.md:58-69.

Technical Analysis

The documented procedure clones the mutable default branch of a personal GitHub repository and immediately runs npm install. It does not pin an immutable commit or release, verify a checksum or signature, or otherwise establish that the fetched source matches a reviewed version.

Running npm install may execute package lifecycle scripts and install mutable transitive dependencies. The resulting code is then installed and enabled as an OpenClaw gateway plugin. The plugin itself is not included in this audit artifact, so its implementation, dependency lock state, lifecycle scripts, and security controls could not be verified.

This external component is expected to receive powerful capabilities, including authenticated WordPress REST access, WP-CLI invocation, media upload, and plugin-file access. Remote installation is necessary only if the optional companion plugin is chosen; using an unpinned source is not necessary for the declared WordPress-management functionality.

Attack Path

1. An attacker compromises the GitHub repository, its maintainer account, or one of its npm dependencies.
2. The attacker inserts malicious code into the default branch or dependency resolution path.
3. A user follows the documented commands and clones the changed repository.
4. npm install executes malicious package code or lifecycle scripts on the OpenClaw gateway host.
5. The user install ...[truncated 778 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation instructions to a reviewed release and immutable commit hash rather than the repository's default branch.
2. Publish and verify cryptographic checksums or signed release artifacts before installation.
3. Include and enforce a reviewed dependency lockfile; use npm ci instead of unconstrained npm install.
4. Audit package lifecycle scripts and consider npm ci --ignore-scripts if the plugin does not require install scripts.
5. Vendor the reviewed plugin into a signed release or distribute it through a controlled, verifiable registry.
6. Install and test the plugin in an isolated staging environment before granting production access.
7. Initially allow only the minimum required tools, such as connection checking and narrowly scoped REST access. Do not grant the plugin-wide shorthand allowlist by default.
8. Use a dedicated, least-privilege WordPress application-password user and avoid production administrator credentials.
9. Enable WP-CLI and plugin-file tools only when necessary, with narrowly constrained profiles and filesystem paths.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/BLOCK_EDITOR.md:15

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: references/BLOCK_EDITOR.md:15-19
Vulnerability Type: Unpinned package retrieval and execution
Risk Level: Medium

Vulnerable Code

bash

npx @wordpress/create-block my-namespace-my-block --namespace my-plugin

Technical Analysis

The instruction invokes npx without an exact package version. If the package is not already installed and pinned locally, npx can retrieve and execute the currently resolved registry version. This makes the effective executable mutable after the Skill has been reviewed.

The package is relevant to the declared block-development functionality and is not inherently malicious. The weakness is the absence of version pinning, lockfile enforcement, and integrity verification. A compromised package release, registry account, or dependency could execute code in the host or CI context where the command is run.

Attack Path

1. An attacker compromises the package publication account, registry resolution path, or a transitive dependency.
2. A malicious or compromised version becomes the version resolved by the unpinned package reference.
3. A user or agent follows the scaffolding instruction on a development host or CI runner.
4. npx downloads and executes the compromised package.
5. The package performs actions with the privileges and accessible credentials of that host process.

Impact Assessment

Exploitation could result in arbitrary code execution under the invoking user's account. Accessible source code, environment variables, repository credentials, CI secrets, and writable project files could be exposed or modified.

The artifact recommends running this on a host or CI environment rather than assuming npm exists on production, which reduces but does not eliminate the risk.

Remediation

View remediation

Remediation Suggestions

1. Specify an approved exact version, for example npx --yes @wordpress/create-block@<reviewed-version> ....
2. Prefer adding the package at an exact version to a development dependency and committing the resulting lockfile.
3. Install with npm ci and invoke the locked local executable through a package script.
4. Review package integrity metadata and dependency changes before upgrading.
5. Execute scaffolding in an isolated development container or restricted CI job without production credentials.
6. Do not run the command on a production WordPress server.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/CONNECTING.md (reported line 36)May include surrounding context.

md

1. **HTTPS**
2. User with appropriate role
3. **Application password:** Users → Profile → Application Passwords → create and store securely (not the login password)
4. **Test REST:** browser `https://your-domain.tld/wp-json/` (subdirectory: `https://domain.tld/blog/wp-json/`)
5. Check security/firewall plugins if REST is blocked

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/SAFETY.md (reported line 25)May include surrounding context.

md

Do not change as side effects unless explicitly requested: `blogname`, `blogdescription`, `show_on_front`, `page_on_front`, `page_for_posts`, `permalink_structure`, `default_role`, `users_can_register`, `template`, `stylesheet`.

For WP-CLI: no bulk `option update` without confirmation.

## Injection

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/USER_EXPECTATIONS.md (reported line 47)May include surrounding context.

md

- **Shop / builder:** Woo, Elementor, etc. **as far as REST or documented automation** goes; else browser or clear manual steps.
- **Tools:** Broader **profiled** WP-CLI allowlists or additional safe tools; REST coverage where useful; small **MU plugin** only for gaps (health, capabilities), not as a substitute for proper APIs.

### As developer (write plugins & extend third parties)

- **New plugins:** Scaffold (structure, `readme.txt`, main file, hooks), **PHP** per WordPress coding standards, **i18n**, **activation/deactivation**, custom REST routes only with permission checks.
- **Extend third-party plugins:** Only via **official/supported** means: `add_action` / `add_filter`, small **bridge** or **addon** plugins on documented hooks (Woo, ACF, etc.—project-specific in references).

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The natural-language content in the changelog uses German exclusively ('aufgeräumt', 'Nutzerorientierter Leitfaden') with no indication that the skill or its documentation is intentionally region-specific. This can violate a language/locale policy when a specific language is imposed without user choice or documented justification.

Content

No source excerpt is available for this finding.