WordPress Publisher Skill

What to check before installing or using this skill: - Verify the source and maintainer: the package metadata shows inconsistent author/homepage data (an account named 'Suspended suspended' and multiple GitHub links). Prefer skills from trusted, well-maintained repositories. If possible, install from the original GitHub repo and confirm its history and issues. - Inspect scripts/wp_publisher.py before handing over credentials: confirm network targets are only the provided site_url and no hard-coded external telemetry or unknown endpoints are contacted. The bundle includes the Python code locally, so review it or run it in a sandbox/staging environment first. - Use least-privilege credentials: create a WordPress Application Password with the minimal role needed (prefer Editor over Administrator where possible) and test on a non-production/staging site first. Do not give your main admin password—the SKILL.md already recommends application passwords. - Validate dependency handling: the repo expects 'requests' but the skill metadata has no install step. Ensure the runtime will install or already provides dependencies; otherwise run the scripts locally in a virtualenv to confirm behavior. - Be aware of HTML passthrough: the converter intentionally preserves some HTML. If you will publish user-provided or untrusted content, review/sanitize it to avoid injecting unwanted HTML or scripts into your site. - Run tests locally (pytest) or inspect tests in this bundle to gain confidence in behavior. If you cannot inspect the code, do not provide credentials to the skill and instead run the included scripts yourself on a controlled machine. If you want, I can scan the full scripts/wp_publisher.py file for network endpoints, data flows, or any code paths that might exfiltrate data, and call out specific lines to review.