技能 white-label
📦

white-label

內容修訂 r1 高風險 ⚙️ 外部命令📁 檔案系統存取🌐 網路存取

套用 WordPress 白標設定

代理商經常需要具品牌識別的 WordPress 管理區，而不依賴付費外掛或手動設定漂移。此技能會引導登入品牌化、儀表板清理、選單與交付檢查的設定與自動化。

支援: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求
Review the Skillstore skill "white-label" from https://skillstore.io/skills/crazyswami-white-label.md and its manifest at https://skillstore.io/api/skills/crazyswami-white-label/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/crazyswami-white-label.md 已簽名 manifest GET /api/skills/crazyswami-white-label/manifest 已簽名 lockfile GET /api/skills/crazyswami-white-label/lockfile

測試它

正在使用「white-label」。 為 Acme Studio 的新客戶網站套用白標。

預期結果:

  • 建議使用 ASE 處理登入安全性、White Label CMS 處理儀表板品牌化，並使用 Branda 處理登入樣式。
  • 在套用設定前列出必要的品牌素材、顏色、登入 slug、儀表板文字與選單變更。
  • 在對目標網站執行 WP-CLI 或 Docker 指令前要求確認。

正在使用「white-label」。 套用品牌化後準備交付。

預期結果:

產出涵蓋登入 URL 測試、標誌檢查、隱藏選單檢視、儀表板清理與外掛設定驗證的檢查清單。

正在使用「white-label」。 疑難排解為什麼品牌化登入標誌遺失。

預期結果:

檢查圖片尺寸、媒體 URL 可存取性、快取狀態、Branda 設定與可能的外掛衝突。

安全審計

高風險
v8 • 2026/7/5 開啟版本化報告

Most Markdown backtick and hardcoded URL findings are documentation false positives. Confirmed risk remains in Bash and WP-CLI automation, fixed /tmp handoff files, raw HTML/CSS option writes, and configurable remote media downloads.

4
已掃描檔案
1,156
分析行數
17
複核項目
0
已忽略的誤報

已確認的安全問題 (2)

高
scripts/configure-white-label.php:180-193scripts/configure-white-label.php:310scripts/white-label-config.example.json:49
Unvalidated HTML and CSS Written to WordPress Options
The WP-CLI script writes config-provided dashboard HTML and custom CSS into plugin options. If a config is generated from untrusted input, this can create stored admin content injection.
Lines 180-193 and 310 assign raw config values to WordPress options, and the example config uses HTML in welcome_message. The risk depends on configuration trust.
中
scripts/configure-white-label.php:53-79SKILL.md:282-289
Configurable Remote Media Download
The script can fetch a logo from a config-provided URL and sideload it into WordPress. Without URL allowlists or private-network checks, this can contact attacker-controlled or internal endpoints.
The code directly passes logo_url to download_url, and the documentation encourages URL-based logo configuration. WordPress may apply some URL safety checks, so confidence is medium.
能力複核項目 (17)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高
scripts/apply-white-label.sh:45
Temp directory access
docker exec "$CONTAINER" wp eval-file /tmp/configure-white-label.php --allow-root
The script executes PHP from /tmp with WP-CLI and --allow-root. This is intended automation, but a modified temp file would run with privileged WordPress access.
中
scripts/apply-white-label.sh:1
Unix shell invocation
#!/bin/bash
This is an executable Bash runner that later calls Docker and WP-CLI against a WordPress site. The behavior is legitimate but requires user confirmation because it changes site state.
中
scripts/apply-white-label.sh:35
Temp directory access
docker cp "$SCRIPT_DIR/configure-white-label.php" "$CONTAINER:/tmp/"
The script copies executable PHP into a predictable /tmp path inside the target container. That file is later executed through WP-CLI, so tampering in a shared container would matter.
中
scripts/apply-white-label.sh:38
Temp directory access
docker cp "$CONFIG_FILE" "$CONTAINER:/tmp/white-label-config.json"
The script copies the user configuration to a fixed /tmp path inside the container. That configuration controls WordPress options, branding HTML, URLs, and security settings.
中
scripts/configure-white-label.php:344
Temp directory access
$config_file = '/tmp/white-label-config.json';
The PHP script trusts a fixed /tmp/white-label-config.json path as its configuration source. A tampered file at that location can drive privileged WordPress option changes.
中
SKILL.md:270-278
Ruby/shell backtick execution
```bash
This fenced bash example tells the agent or user to run the white-label script from the skill directory. It is documentation, but it is an instruction to execute local automation.
中
SKILL.md:363-372
Ruby/shell backtick execution
```bash
This bash block instructs Docker and WP-CLI commands to read WordPress option values. It is legitimate administration, but it can expose site configuration from the selected container.
中
SKILL.md:377-390
Ruby/shell backtick execution
```bash
This bash block instructs a WP-CLI option update that changes security and admin settings. Running it against the wrong site would modify live WordPress behavior.
中
SKILL.md:393-403
Ruby/shell backtick execution
```bash
This bash block includes Docker and WP-CLI media import and option update commands. It is an administrative action that changes site assets and plugin settings.
中
SKILL.md:411-462
Ruby/shell backtick execution
```bash
The documented automation script uses Bash, Docker Compose, WP-CLI, and file copying to modify WordPress options. It should not run without target confirmation.
中
SKILL.md:398
Shell command substitution
LOGO_ID=$(docker exec wordpress wp post list --post_type=attachment --name=logo --field=ID)
The command substitution runs Docker and WP-CLI to select a media attachment ID. It is not shell injection, but it is still executable site administration in the skill instructions.
中
SKILL.md:422-448
Shell command substitution
docker-compose exec -T wpcli wp option update admin_site_enhancements "$(cat <<EOF
The heredoc command substitution builds WP-CLI option data from shell variables and writes it to WordPress. Unreviewed values could produce unwanted site configuration changes.
中
SKILL.md:393-403
Template literal with command substitution
```bash
The bash example includes command substitution and Docker/WP-CLI operations for media import and option updates. This is legitimate but requires confirmation before execution.
中
SKILL.md:411-462
Template literal with command substitution
```bash
The automation example contains command substitution and variable interpolation while updating WordPress options. It can change live site behavior if run against a real container.
中
SKILL.md:412
Unix shell invocation
#!/bin/bash
The Markdown block presents a Bash automation script for users or agents to execute. The shell use is intended, but it performs privileged WordPress configuration.
中
SKILL.md:452
Temp directory access
docker cp "$LOGO_PATH" wordpress:/tmp/logo.png
The example copies a logo to a fixed /tmp/logo.png path in the WordPress container. A predictable temp path can be overwritten or confused in shared environments.
中
SKILL.md:453
Temp directory access
docker-compose exec -T wpcli wp media import /tmp/logo.png --title="$CLIENT_NAME Logo"
The example imports media from the same predictable /tmp/logo.png path. The action is legitimate, but it relies on a temp file that should be unique and verified.

風險因素

⚙️ 外部命令 (38)
scripts/apply-white-label.sh:16 scripts/apply-white-label.sh:1 SKILL.md:44 SKILL.md:57 SKILL.md:69 SKILL.md:70 SKILL.md:73-78 SKILL.md:78-80 SKILL.md:80 SKILL.md:116-124 SKILL.md:124-150 SKILL.md:150-152 SKILL.md:152-270 SKILL.md:270-278 SKILL.md:278-284 SKILL.md:284-315 SKILL.md:315-342 SKILL.md:342-347 SKILL.md:347-353 SKILL.md:353-357 SKILL.md:357-358 SKILL.md:358-359 SKILL.md:359 SKILL.md:363-372 SKILL.md:372-377 SKILL.md:377-390 SKILL.md:390-393 SKILL.md:393-403 SKILL.md:403-411 SKILL.md:411-462 SKILL.md:462-470 SKILL.md:470-538 SKILL.md:398 SKILL.md:422-448 SKILL.md:458 SKILL.md:393-403 SKILL.md:411-462 SKILL.md:412
📁 檔案系統存取 (13)
scripts/apply-white-label.sh:48 scripts/apply-white-label.sh:50 scripts/apply-white-label.sh:35 scripts/apply-white-label.sh:38 scripts/apply-white-label.sh:45 scripts/apply-white-label.sh:48 scripts/configure-white-label.php:35 scripts/configure-white-label.php:344 SKILL.md:272 SKILL.md:275 SKILL.md:343 SKILL.md:452 SKILL.md:453
🌐 網路存取 (8)
scripts/white-label-config.example.json:5 SKILL.md:151 SKILL.md:288 SKILL.md:289 SKILL.md:605 SKILL.md:606 SKILL.md:607 SKILL.md:608
審計單位: codex 檢視審計紀錄 →
分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告
安全評估

複製報告連結

https://skillstore.io/skills/crazyswami-white-label/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/crazyswami-white-label/security.svg)](https://skillstore.io/skills/crazyswami-white-label?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/crazyswami-white-label?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/crazyswami-white-label/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/crazyswami-white-label.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
學術引用 (APA · BibTeX · CFF)

APA 引用

CrazySwami. (2026). white-label security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/crazyswami-white-label/audits/8

BibTeX 引用

@techreport{crazyswami-crazyswami-white-label-2026, author = {CrazySwami}, title = {white-label security audit report (audit version 8)}, institution = {Skillstore}, year = {2026}, number = {8}, url = {https://skillstore.io/skills/crazyswami-white-label/audits/8}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "white-label security audit report (audit version 8)" version: "unspecified" type: report authors: - name: "CrazySwami" date-released: "2026-07-05" url: "https://skillstore.io/skills/crazyswami-white-label/audits/8" identifiers: - type: other value: "skillstore:crazyswami-white-label:audit:8" description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據 證據置信度: 中
45
架構
85
可維護性
87
內容
70
社群
78
規範符合度

你可以打造什麼

為客戶網站套用品牌化

將代理商或客戶品牌套用到 WordPress 登入頁、管理後台頁尾、儀表板與選單標籤。

準備客戶交付

清理進階管理後台畫面、驗證品牌化元素，並產出實用的交付檢查清單。

標準化可重複使用的設定

使用免費外掛與 WP-CLI，為多個 WordPress 專案建立可重複的設定流程。

試試這些提示

規劃白標設定 
使用此技能為 [Company] 規劃 WordPress 白標設定。包含登入品牌化、儀表板清理、選單與安全性檢查。
準備品牌設定 
為 [Company] 準備白標設定，標誌 URL 為 [URL]、主要色彩為 [color]、登入 slug 為 [slug]。先說明每項設定。
套用預備環境設定 
檢視我的 WordPress 容器 [container] 與設定檔 [path]。確認目標後，套用白標腳本並摘要變更。
稽核客戶交付 
檢查 [site] 已完成的白標設定。驗證外掛設定、隱藏選單、登入 URL、XML-RPC、作者 slug 與交付風險。

最佳實務

  • 在套用白標自動化前備份網站與資料庫。
  • 在執行指令前確認確切的 WordPress 網站、Docker 容器與設定檔。
  • 在儲存外掛選項前，清理遠端媒體 URL、儀表板 HTML 與自訂 CSS。

避免

  • 不要在沒有備份與明確確認的情況下，對正式環境執行自動化腳本。
  • 不要在設定檔中使用不可信任的標誌 URL、儀表板 HTML 或自訂 CSS。
  • 不要隱藏網站維護者進行安全性、更新或復原所需的管理選單。

常見問題

此技能需要付費外掛嗎？
不需要。它著重於免費外掛，包括 ASE、White Label CMS、Branda，以及選用的 Admin Menu Editor。
它可以針對 Docker 型 WordPress 網站執行嗎？
可以。當容器內可使用 WP-CLI 時，內含的 shell 腳本支援以 Docker 容器作為目標。
它可以在本機 WordPress 安裝上執行嗎？
可以。未提供 Docker 容器參數時，它可以使用本機 WP-CLI。
它會變更安全性設定嗎？
會。它可以設定登入 URL 變更、停用 XML-RPC、作者 slug 混淆與電子郵件混淆。
執行自動化前應檢視哪些項目？
請檢視目標網站、設定檔、標誌 URL、自訂 HTML、自訂 CSS 與備份狀態。
此自動化對不可信任的設定檔安全嗎？
不安全。請將設定檔視為可信任的管理員輸入，因為它們可能影響品牌化、HTML、CSS 與網站選項。

開發者詳細資訊

作者

CrazySwami

授權

MIT

Skillstore 修訂

r1

版本提示

作者未聲明版本。

儲存庫

https://github.com/CrazySwami/wordpress-dev-skills/tree/main/skills/white-label

引用

02f077c174c5335e2f5d02ca15e77b70d9543e58

維護新鮮度

2026/7/22

使用量

4 次下載 · 215 次瀏覽

檔案結構

📁 scripts/

📄 apply-white-label.sh

📄 configure-white-label.php

📄 white-label-config.example.json

📄 SKILL.md

CrazySwami 的更多技能

查看全部

相關技能

查看全部