Skills white-label

📦

white-label

Name: white-label
Author: CrazySwami

Content revision r1 High Risk ⚙️ External commands📁 Filesystem access🌐 Network access

Apply WordPress White Labeling

Agencies often need branded WordPress admin areas without paid plugins or manual drift. This skill guides setup and automation for login branding, dashboard cleanup, menus, and handoff checks.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "white-label" from https://skillstore.io/skills/crazyswami-white-label.md and its manifest at https://skillstore.io/api/skills/crazyswami-white-label/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/crazyswami-white-label.md Signed manifest GET /api/skills/crazyswami-white-label/manifest Signed lockfile GET /api/skills/crazyswami-white-label/lockfile

Test it

Using "white-label". White-label a new client site for Acme Studio.

Expected outcome:

Recommends ASE for login security, White Label CMS for dashboard branding, and Branda for login styling.
Lists required brand assets, colors, login slug, dashboard text, and menu changes before applying settings.
Requests confirmation before running WP-CLI or Docker commands against the target site.

Using "white-label". Prepare handoff after applying the branding.

Expected outcome:

Produces a checklist covering login URL tests, logo checks, hidden menu review, dashboard cleanup, and plugin setting verification.

Using "white-label". Troubleshoot why the branded login logo is missing.

Expected outcome:

Checks image dimensions, media URL accessibility, cache state, Branda settings, and possible plugin conflicts.

Security Audit

High Risk

v8 • 7/5/2026 Open versioned report

Most Markdown backtick and hardcoded URL findings are documentation false positives. Confirmed risk remains in Bash and WP-CLI automation, fixed /tmp handoff files, raw HTML/CSS option writes, and configurable remote media downloads.

Files scanned

1,156

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

scripts/configure-white-label.php:180-193 scripts/configure-white-label.php:310 scripts/white-label-config.example.json:49

Unvalidated HTML and CSS Written to WordPress Options

The WP-CLI script writes config-provided dashboard HTML and custom CSS into plugin options. If a config is generated from untrusted input, this can create stored admin content injection.

Lines 180-193 and 310 assign raw config values to WordPress options, and the example config uses HTML in welcome_message. The risk depends on configuration trust.

Medium

scripts/configure-white-label.php:53-79 SKILL.md:282-289

Configurable Remote Media Download

The script can fetch a logo from a config-provided URL and sideload it into WordPress. Without URL allowlists or private-network checks, this can contact attacker-controlled or internal endpoints.

The code directly passes logo_url to download_url, and the documentation encourages URL-based logo configuration. WordPress may apply some URL safety checks, so confidence is medium.

Capability review items (17)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/apply-white-label.sh:45

Temp directory access

docker exec "$CONTAINER" wp eval-file /tmp/configure-white-label.php --allow-root

The script executes PHP from /tmp with WP-CLI and --allow-root. This is intended automation, but a modified temp file would run with privileged WordPress access.

Medium

scripts/apply-white-label.sh:1

Unix shell invocation

#!/bin/bash

This is an executable Bash runner that later calls Docker and WP-CLI against a WordPress site. The behavior is legitimate but requires user confirmation because it changes site state.

Medium

scripts/apply-white-label.sh:35

Temp directory access

docker cp "$SCRIPT_DIR/configure-white-label.php" "$CONTAINER:/tmp/"

The script copies executable PHP into a predictable /tmp path inside the target container. That file is later executed through WP-CLI, so tampering in a shared container would matter.

Medium

scripts/apply-white-label.sh:38

Temp directory access

docker cp "$CONFIG_FILE" "$CONTAINER:/tmp/white-label-config.json"

The script copies the user configuration to a fixed /tmp path inside the container. That configuration controls WordPress options, branding HTML, URLs, and security settings.

Medium

scripts/configure-white-label.php:344

Temp directory access

$config_file = '/tmp/white-label-config.json';

The PHP script trusts a fixed /tmp/white-label-config.json path as its configuration source. A tampered file at that location can drive privileged WordPress option changes.

Medium

SKILL.md:270-278

Ruby/shell backtick execution

```bash

This fenced bash example tells the agent or user to run the white-label script from the skill directory. It is documentation, but it is an instruction to execute local automation.

Medium

SKILL.md:363-372

Ruby/shell backtick execution

```bash

This bash block instructs Docker and WP-CLI commands to read WordPress option values. It is legitimate administration, but it can expose site configuration from the selected container.

Medium

SKILL.md:377-390

Ruby/shell backtick execution

```bash

This bash block instructs a WP-CLI option update that changes security and admin settings. Running it against the wrong site would modify live WordPress behavior.

Medium

SKILL.md:393-403

Ruby/shell backtick execution

```bash

This bash block includes Docker and WP-CLI media import and option update commands. It is an administrative action that changes site assets and plugin settings.

Medium

SKILL.md:411-462

Ruby/shell backtick execution

```bash

The documented automation script uses Bash, Docker Compose, WP-CLI, and file copying to modify WordPress options. It should not run without target confirmation.

Medium

SKILL.md:398

Shell command substitution

LOGO_ID=$(docker exec wordpress wp post list --post_type=attachment --name=logo --field=ID)

The command substitution runs Docker and WP-CLI to select a media attachment ID. It is not shell injection, but it is still executable site administration in the skill instructions.

Medium

SKILL.md:422-448

Shell command substitution

docker-compose exec -T wpcli wp option update admin_site_enhancements "$(cat <<EOF

The heredoc command substitution builds WP-CLI option data from shell variables and writes it to WordPress. Unreviewed values could produce unwanted site configuration changes.

Medium

SKILL.md:393-403

Template literal with command substitution

```bash

The bash example includes command substitution and Docker/WP-CLI operations for media import and option updates. This is legitimate but requires confirmation before execution.

Medium

SKILL.md:411-462

Template literal with command substitution

```bash

The automation example contains command substitution and variable interpolation while updating WordPress options. It can change live site behavior if run against a real container.

Medium

SKILL.md:412

Unix shell invocation

#!/bin/bash

The Markdown block presents a Bash automation script for users or agents to execute. The shell use is intended, but it performs privileged WordPress configuration.

Medium

SKILL.md:452

Temp directory access

docker cp "$LOGO_PATH" wordpress:/tmp/logo.png

The example copies a logo to a fixed /tmp/logo.png path in the WordPress container. A predictable temp path can be overwritten or confused in shared environments.

Medium

SKILL.md:453

Temp directory access

docker-compose exec -T wpcli wp media import /tmp/logo.png --title="$CLIENT_NAME Logo"

The example imports media from the same predictable /tmp/logo.png path. The action is legitimate, but it relies on a temp file that should be unique and verified.

Risk Factors

⚙️ External commands (38)

📁 Filesystem access (13)

scripts/apply-white-label.sh:48 scripts/apply-white-label.sh:50 scripts/apply-white-label.sh:35 scripts/apply-white-label.sh:38 scripts/apply-white-label.sh:45 scripts/apply-white-label.sh:48 scripts/configure-white-label.php:35 scripts/configure-white-label.php:344 SKILL.md:272 SKILL.md:275 SKILL.md:343 SKILL.md:452 SKILL.md:453

🌐 Network access (8)

scripts/white-label-config.example.json:5 SKILL.md:151 SKILL.md:288 SKILL.md:289 SKILL.md:605 SKILL.md:606 SKILL.md:607 SKILL.md:608

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/crazyswami-white-label/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/crazyswami-white-label/security.svg)](https://skillstore.io/skills/crazyswami-white-label?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/crazyswami-white-label?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/crazyswami-white-label/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/crazyswami-white-label.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

CrazySwami. (2026). white-label security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/crazyswami-white-label/audits/8

BibTeX citation

@techreport{crazyswami-crazyswami-white-label-2026,
  author = {CrazySwami},
  title = {white-label security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/crazyswami-white-label/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "white-label security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "CrazySwami"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/crazyswami-white-label/audits/8"
identifiers:
  - type: other
    value: "skillstore:crazyswami-white-label:audit:8"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Brand a Client Site

Apply agency or client branding to the WordPress login page, admin footer, dashboard, and menu labels.

Prepare Client Handoff

Clean up advanced admin screens, verify branded elements, and produce a practical handoff checklist.

Standardize Reusable Setups

Create a repeatable configuration flow for multiple WordPress projects using free plugins and WP-CLI.

Try These Prompts

Plan a White-Label Setup

Use this skill to plan a WordPress white-label setup for [Company]. Include login branding, dashboard cleanup, menus, and security checks.

Prepare Brand Settings

Prepare white-label settings for [Company] with logo URL [URL], primary color [color], and login slug [slug]. Explain each setting first.

Apply a Staged Setup

Review my WordPress container [container] and config file [path]. Confirm the target, then apply the white-label script and summarize changes.

Audit a Client Handoff

Inspect the completed white-label setup for [site]. Verify plugin settings, hidden menus, login URL, XML-RPC, author slugs, and handoff risks.

Best Practices

Back up the site and database before applying white-label automation.
Confirm the exact WordPress site, Docker container, and configuration file before running commands.
Sanitize remote media URLs, dashboard HTML, and custom CSS before saving plugin options.

Avoid

Do not run the automation script against production without a backup and explicit confirmation.
Do not use untrusted logo URLs, dashboard HTML, or custom CSS in the configuration file.
Do not hide admin menus that site maintainers need for security, updates, or recovery.