Skills wordpress-admin
📦
wordpress-admin
Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Manage WordPress Pages and SEO
WordPress administration often requires repeated page, SEO, media, and deployment steps across CLI and REST tools. This skill provides documented workflows and helper scripts for structured WordPress operations.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "wordpress-admin" from https://skillstore.io/skills/crazyswami-wordpress-admin.md and its manifest at https://skillstore.io/api/skills/crazyswami-wordpress-admin/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "wordpress-admin". Create a draft Privacy Policy page with a matching slug and template.
Expected outcome:
The assistant reports the created page identifier, confirms draft status, and lists the template and slug applied.
Using "wordpress-admin". Set Yoast SEO metadata for an existing page.
Expected outcome:
The assistant confirms which SEO fields were updated and warns if title or meta description length exceeds recommended limits.
Using "wordpress-admin". Plan a production content update.
Expected outcome:
The assistant returns a short change plan with target site, affected files, credential requirements, validation steps, and rollback notes.
Security Audit
Criticalv8 • 7/6/2026 Open versioned report
The bundled scripts contain real shell-command injection risk because WP-CLI commands are assembled as strings and executed with shell=True. The documentation also exposes credentials and includes production or destructive workflows without sufficient guardrails, while many Markdown fence and URL hits are false positives.
3
Files scanned
679
Lines analyzed
26
Review items
0
False positives ignored
Confirmed security concerns (2)
Critical
Hardcoded Credentials in Skill Documentation
The skill publishes local WordPress credentials and a production lftp command containing a literal password. If valid, these credentials enable unauthorized administrative or file access.
Line 36 exposes an admin username and password, and line 250 embeds an FTP username and literal password in an lftp command. These are direct credential disclosure indicators.
High
Production and Destructive Operations Lack Guardrails
The skill demonstrates production REST writes, FTP theme uploads, database resets, and force deletion workflows without explicit confirmation or dry-run requirements. Automated use could publish, delete, or overwrite site content.
The cited documentation and script paths directly create production content, upload theme files, reset databases, and delete pages. No approval, backup, or environment verification checks are shown.
Capability review items (26)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Python subprocess.run
result = subprocess.run(full_cmd, shell=True, capture_output=True, text=True)
subprocess.run uses shell=True with a command string assembled from page titles, slugs, content, status, templates, or post IDs. Those values can be user controlled, creating a command injection path into docker exec and WP-CLI.
High
Python subprocess.run
result = subprocess.run(full_cmd, shell=True, capture_output=True, text=True)
subprocess.run uses shell=True with a command string assembled from page titles, slugs, content, status, templates, or post IDs. Those values can be user controlled, creating a command injection path into docker exec and WP-CLI.
High
Python subprocess.run
result = subprocess.run(full_cmd, shell=True, capture_output=True, text=True)
subprocess.run uses shell=True with a command string that includes post IDs and SEO values from CLI arguments. The escaping is incomplete for shell metacharacters, so command injection remains possible.
High
Ruby/shell backtick execution
```bash
This bash block documents resetting the WordPress database with docker-compose down -v. That is destructive and can delete local site data.
High
Ruby/shell backtick execution
```bash
This bash block documents syncing theme files to a remote system. File synchronization can overwrite production content if misused.
High
Ruby/shell backtick execution
```bash
This bash block contains an lftp production upload command with embedded credentials in the following line. It is a real high-risk external command workflow.
Medium
Ruby/shell backtick execution
- **WP-CLI:** `docker exec wordpress-local-wordpress-1 wp <command> --allow-root`
This line documents a Docker WP-CLI command that an agent may execute. It is an intended admin capability, but it grants shell-level WordPress control.
Medium
Ruby/shell backtick execution
```bash
This bash block documents page creation with docker exec and WP-CLI. It is expected functionality, but it can publish content through shell commands.
Medium
Ruby/shell backtick execution
```bash
This bash block documents a production REST API POST using curl. It can create live WordPress content and therefore represents real networked command risk.
Medium
Ruby/shell backtick execution
```bash
This bash block documents updating WordPress post metadata through docker exec. It is legitimate admin usage but still changes site state through shell commands.
Medium
Ruby/shell backtick execution
```bash
This bash block documents multiple WP-CLI metadata writes for Yoast SEO. It is intentional but can modify live content metadata if used on the wrong target.
Medium
Ruby/shell backtick execution
```bash
This bash block documents importing media from an external URL through WP-CLI. It is a legitimate workflow, but it performs network and site-write actions.
Medium
Ruby/shell backtick execution
```bash
This bash block documents changing a featured image by post metadata update. It is a real site mutation through shell commands.
Medium
Ruby/shell backtick execution
```bash
This bash block documents WP-CLI post listing commands. The impact is mostly read-only, but it still relies on shell command execution.
Medium
Ruby/shell backtick execution
```bash
This bash block documents plugin listing and installation through WP-CLI. Plugin installation can materially change a WordPress site.
Medium
Ruby/shell backtick execution
- **Search:** `curl -H "Authorization: API_KEY" "https://api.pexels.com/v1/search?query=TERM&per_pag
This line documents a curl request to Pexels with an authorization header placeholder. It is an intended API call, but it still exposes users to command-line secret handling risk.
Medium
Ruby/shell backtick execution
- **Search:** `curl "https://api.unsplash.com/search/photos?query=TERM&client_id=API_KEY"`
This line documents a curl request to Unsplash with an API key placeholder. It is an intended API call, but command-line key usage can leak through logs or shell history.
Medium
Ruby/shell backtick execution
```bash
This bash block documents running the bundled page helper script. That helper builds WP-CLI shell commands from CLI arguments, so execution has real risk.
Medium
Ruby/shell backtick execution
```bash
This bash block documents running the bundled SEO helper script. That helper builds WP-CLI shell commands from CLI arguments, so execution has real risk.
Medium
Ruby/shell backtick execution
```bash
This bash block documents running a media helper script, but that helper is not included in the package. Kept as low-confidence command risk because the workflow asks the agent to execute Python from a root path.
Medium
Ruby/shell backtick execution
```bash
This bash block documents starting a Docker Compose WordPress environment. It is expected administration, but it changes local service state.
Medium
Ruby/shell backtick execution
```bash
This bash block documents stopping the Docker Compose WordPress environment. It is expected administration, but it changes local service availability.
Medium
Ruby/shell backtick execution
```bash
This bash block documents viewing Docker logs. The operation is mostly read-only, but it can expose sensitive application data in logs.
Medium
Hidden file access
- **API Key:** Store in `/root/.pexels-api-key`
The documentation instructs users to store the Pexels API key in a root-owned hidden file. This is secret handling in the filesystem and needs permissions, rotation, and safer storage guidance.
Medium
Hidden file access
- **API Key:** Store in `/root/.unsplash-api-key`
The documentation instructs users to store the Unsplash API key in a root-owned hidden file. This is secret handling in the filesystem and needs permissions, rotation, and safer storage guidance.
Low
Hardcoded URL
curl -X POST "https://csrdevelopment.com/wp-json/wp/v2/pages" \
This line documents a curl POST to a hardcoded production WordPress REST endpoint. It is an intended workflow, but it can create live content on an external site.
Risk Factors
⚙️ External commands (49)
scripts/wp-page.py:30 scripts/wp-page.py:34 scripts/wp-seo.py:40 SKILL.md:34 SKILL.md:43-50 SKILL.md:50-53 SKILL.md:53-63 SKILL.md:63-67 SKILL.md:67-69 SKILL.md:69-75 SKILL.md:75-84 SKILL.md:84-89 SKILL.md:89-91 SKILL.md:91-94 SKILL.md:94-96 SKILL.md:96-100 SKILL.md:100-104 SKILL.md:104-108 SKILL.md:108-114 SKILL.md:114-141 SKILL.md:141-143 SKILL.md:143-166 SKILL.md:166-171 SKILL.md:171-172 SKILL.md:172-173 SKILL.md:173 SKILL.md:176-177 SKILL.md:177-185 SKILL.md:185-193 SKILL.md:193-199 SKILL.md:199-206 SKILL.md:206-212 SKILL.md:212-217 SKILL.md:217-222 SKILL.md:222-224 SKILL.md:224-227 SKILL.md:227-229 SKILL.md:229-232 SKILL.md:232-234 SKILL.md:234-237 SKILL.md:237-239 SKILL.md:239-244 SKILL.md:244-246 SKILL.md:246-249 SKILL.md:249-256 SKILL.md:256-261 SKILL.md:261-262 SKILL.md:262-268 SKILL.md:268-269
🌐 Network access (18)
📁 Filesystem access (5)
🔑 Env variables (2)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/crazyswami-wordpress-admin/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/crazyswami-wordpress-admin?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/crazyswami-wordpress-admin?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/crazyswami-wordpress-admin/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/crazyswami-wordpress-admin.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
CrazySwami. (2026). wordpress-admin security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/crazyswami-wordpress-admin/audits/8BibTeX citation
@techreport{crazyswami-crazyswami-wordpress-admin-2026,
author = {CrazySwami},
title = {wordpress-admin security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/crazyswami-wordpress-admin/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wordpress-admin security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "CrazySwami"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/crazyswami-wordpress-admin/audits/8"
identifiers:
- type: other
value: "skillstore:crazyswami-wordpress-admin:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 45
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Create Standard Site Pages
Draft and publish WordPress pages with slugs, templates, status values, and optional content through WP-CLI helper commands.
Maintain SEO Metadata
Set Yoast focus keywords, meta descriptions, SEO titles, canonical URLs, and robots flags for existing posts or pages.
Operate a Local WordPress Stack
Use documented Docker and WP-CLI workflows to start, stop, inspect, and reset a local WordPress development environment.
Try These Prompts
Create a Basic Page
Create a WordPress page titled Privacy Policy with slug privacy-policy. Use draft status and tell me the resulting page identifier.
Update SEO Fields
Set Yoast SEO fields for page 123. Use focus keyphrase Miami real estate, a concise meta description, and a 60 character title.
Review Site Content Setup
List current WordPress pages, identify missing legal pages, and propose the exact page titles, slugs, templates, and SEO metadata to add.
Plan a Safe Production Change
Prepare a production WordPress page and theme update plan. Include target verification, backup steps, dry run checks, and rollback actions.
Best Practices
- Confirm the target site and environment before running any WordPress command.
- Use draft status and dry run checks before publishing or syncing production changes.
- Store credentials outside skill files and rotate any credentials that were committed.
Avoid
- Do not run production FTP or REST commands with hardcoded credentials.
- Do not reset a WordPress database without a verified backup and explicit approval.
- Do not pass untrusted page titles, slugs, or metadata directly into shell commands.
Frequently Asked Questions
Does this skill support production WordPress sites?
The documentation includes production REST and FTP examples, but the included Python scripts only implement local Docker operations.
Can it manage Yoast SEO fields?
Yes. The wp-seo.py script can set and read common Yoast metadata through local WP-CLI commands.
Does it include media upload automation?
It documents media workflows, but the referenced wp-media.py script is not included in the package.
Which tools does it expect?
It expects WordPress, WP-CLI, Docker, curl, Python 3, and lftp for the documented workflows.
Is it safe for automatic installation?
It needs security remediation first because it exposes credentials and builds shell commands from user-controlled values.
What should users configure before use?
Users should provide their own site configuration, secret storage, backups, and approval process before running administrative actions.
Developer Details
Author
CrazySwamiLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
d11af420e07cd866fe39cfa937efef3223896c06
Maintenance freshness
7/22/2026
Usage
6 downloads · 192 views
File structure