Skills siteground-cache
📦

siteground-cache

Content revision r1 High Risk ⚙️ External commands📁 Filesystem access🌐 Network access

Bypass SiteGround Cache for WordPress Staging

WordPress developers often cannot see theme changes because SiteGround, LiteSpeed, or browser caches serve old assets. This skill adds and removes a staging-only cache-busting snippet for child themes and guides verification.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "siteground-cache" from https://skillstore.io/skills/crazyswami-siteground-cache.md and its manifest at https://skillstore.io/api/skills/crazyswami-siteground-cache/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/crazyswami-siteground-cache.md Signed manifest GET /api/skills/crazyswami-siteground-cache/manifest Signed lockfile GET /api/skills/crazyswami-siteground-cache/lockfile

Test it

Using "siteground-cache". Add cache busting to my staging child theme.

Expected outcome:

  • Confirms the target is a staging child theme.
  • Creates a backup of the current functions.php file.
  • Adds the cache-busting functions and reports the inserted behavior.
  • Provides staging verification steps for the admin banner and refreshed assets.

Using "siteground-cache". Remove the cache buster before production release.

Expected outcome:

  • Creates a fresh backup before cleanup.
  • Removes the SiteGround cache-busting functions and related comments.
  • Summarizes what was removed and recommends a final staging check.

Using "siteground-cache". Review my SiteGround staging deployment plan.

Expected outcome:

  • Identifies whether the plan uses staging-only paths.
  • Calls out credential storage and plain FTP risks.
  • Recommends safer transfer and rollback steps.

Security Audit

High Risk
v8 • 7/6/2026 Open versioned report

Most Markdown-related static findings are false positives caused by code fences and inline examples. The bundled shell scripts are scoped local file editors, but the skill contains substantive risks in credential handling and insecure FTP deployment guidance. Publication should require clearer secret-handling safeguards and secure transfer instructions.

4
Files scanned
627
Lines analyzed
4
Review items
0
False positives ignored

Confirmed security concerns (2)

High
SKILL.md:36-49SKILL.md:191-208SKILL.md:302-309
Plaintext Credential Handling Guidance
The skill tells the agent to ask for FTP credentials and store them in a project-local CLAUDE.local.md file. That can expose hosting passwords to future sessions, local tooling, backups, or accidental sharing even when the file is intended to be gitignored.
The instructions explicitly request host, username, password, and port, then recommend storing credentials in CLAUDE.local.md. This is direct evidence of plaintext secret handling guidance.
High
SKILL.md:202-208
Insecure FTP Deployment Example
The staging deployment example disables certificate verification and uses an ftp:// endpoint. This combination can expose credentials or site files to interception during deployment.
The documented lftp command includes certificate verification disabled and a plain FTP URL. These are clear insecure transport indicators.
Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
SKILL.md:202-209
Ruby/shell backtick execution
```bash
The block beginning at this line instructs use of lftp with credentials and disabled certificate verification. Although the detector label is imprecise, following the documented shell command creates a real credential exposure risk.
High
SKILL.md:208
FTP protocol
" ftp://ftp.example.com
The deployment example uses ftp:// for transferring site files. Plain FTP can expose credentials and content in transit, especially when paired with password-based deployment.
Medium
add-cache-buster.sh:1
Unix shell invocation
#!/bin/bash
This is an executable shell script that modifies a WordPress theme file. The commands appear scoped and quoted, but running bundled shell scripts still requires user trust and confirmation.
Medium
remove-cache-buster.sh:1
Unix shell invocation
#!/bin/bash
This is an executable shell script that rewrites functions.php during removal. No command injection is apparent, but the script performs local file mutation and should be run only with explicit approval.

Risk Factors

⚙️ External commands (38)
add-cache-buster.sh:22 add-cache-buster.sh:79 add-cache-buster.sh:85 add-cache-buster.sh:90 add-cache-buster.sh:1 remove-cache-buster.sh:52 remove-cache-buster.sh:57 remove-cache-buster.sh:1 SKILL.md:37 SKILL.md:43 SKILL.md:47 SKILL.md:49 SKILL.md:55-59 SKILL.md:59-79 SKILL.md:79-153 SKILL.md:153-161 SKILL.md:161-167 SKILL.md:167-172 SKILL.md:172-192 SKILL.md:192-198 SKILL.md:198-202 SKILL.md:202-209 SKILL.md:209-222 SKILL.md:222-234 SKILL.md:234-241 SKILL.md:241-243 SKILL.md:243-247 SKILL.md:247-249 SKILL.md:249-253 SKILL.md:253-256 SKILL.md:256-260 SKILL.md:260-262 SKILL.md:262-263 SKILL.md:263-281 SKILL.md:281-288 SKILL.md:288-294 SKILL.md:294-302 SKILL.md:302-318
📁 Filesystem access (4)
remove-cache-buster.sh:86 remove-cache-buster.sh:57 SKILL.md:166 SKILL.md:289
🌐 Network access (4)
SKILL.md:43 SKILL.md:312 SKILL.md:313 SKILL.md:208
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/crazyswami-siteground-cache/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/crazyswami-siteground-cache/security.svg)](https://skillstore.io/skills/crazyswami-siteground-cache?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/crazyswami-siteground-cache?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/crazyswami-siteground-cache/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/crazyswami-siteground-cache.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

CrazySwami. (2026). siteground-cache security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/crazyswami-siteground-cache/audits/8

BibTeX citation

@techreport{crazyswami-crazyswami-siteground-cache-2026, author = {CrazySwami}, title = {siteground-cache security audit report (audit version 8)}, institution = {Skillstore}, year = {2026}, number = {8}, url = {https://skillstore.io/skills/crazyswami-siteground-cache/audits/8}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "siteground-cache security audit report (audit version 8)" version: "unspecified" type: report authors: - name: "CrazySwami" date-released: "2026-07-06" url: "https://skillstore.io/skills/crazyswami-siteground-cache/audits/8" identifiers: - type: other value: "skillstore:crazyswami-siteground-cache:audit:8" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance

What You Can Build

Preview Theme Changes on Staging

Add temporary cache bypass logic so CSS and JavaScript changes appear during SiteGround staging review.

Prepare a Clean Production Release

Remove the development cache buster and verify that temporary functions are gone before launch.

Debug SiteGround Cache Behavior

Check whether LiteSpeed, SG CachePress, browser cache, or CDN layers are hiding recent theme changes.

Try These Prompts

Install on Staging 
Add SiteGround cache busting to the staging child theme at [path]. Create a backup first and summarize what changed.
Verify Cache Bypass 
Check whether the SiteGround cache buster is active on staging. Review the theme files and list safe verification steps.
Remove Before Launch 
Remove the SiteGround cache buster from the child theme at [path]. Preserve a backup and confirm which functions were removed.
Plan Secure Deployment 
Review my staging deployment plan for this SiteGround cache-busting change. Flag credential risks, insecure transfer steps, and production safety checks.

Best Practices

  • Use this only on staging or local development and remove it before production release.
  • Keep backups of functions.php and review inserted PHP before deployment.
  • Prefer SFTP or managed deployment over plain FTP when transferring files.

Avoid

  • Do not store real FTP passwords in shared project files or commit them.
  • Do not use the cache buster as a permanent production performance setting.
  • Do not deploy to production only because a path or host name contains staging.

Frequently Asked Questions

Does this skill disable caching for all visitors?
No. The included PHP checks for administrator capability before adding headers, banners, and asset timestamps.
Can I use it on production?
It is designed for staging and development. Remove the snippet before production release.
Does it purge SiteGround or Cloudflare caches?
No. It changes WordPress output for administrators and adds asset timestamps, but it does not call hosting or CDN APIs.
What files does it modify?
The installer and remover target the child theme functions.php file and create timestamped backups.
Is FTP required?
No. The documentation includes FTP examples, but SFTP or a managed deployment workflow is safer.
What should I check after installing it?
Log in as an administrator on staging, confirm the banner appears, and verify CSS or JavaScript URLs include fresh version parameters.

Developer Details

Author

CrazySwami

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/CrazySwami/wordpress-dev-skills/tree/main/skills/siteground-cache

Ref

d11af420e07cd866fe39cfa937efef3223896c06

Maintenance freshness

7/18/2026

Usage

4 downloads · 222 views

File structure

📄 add-cache-buster.sh

📄 cache-buster.php

📄 remove-cache-buster.sh

📄 SKILL.md