技能 wp-playground
📦

wp-playground

內容修訂 r1 中風險 🌐 網路存取⚙️ 外部命令📁 檔案系統存取

啟動 WordPress Playground 測試網站

WordPress 測試經常需要一個快速網站，而不必使用 Docker 或主機服務。此技能會引導 Claude、Codex 和 Claude Code 使用 Playground URL、blueprint、CLI 用法與示範。

支援: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 50 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求
Review the Skillstore skill "wp-playground" from https://skillstore.io/skills/crazyswami-wp-playground.md and its manifest at https://skillstore.io/api/skills/crazyswami-wp-playground/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/crazyswami-wp-playground.md 已簽名 manifest GET /api/skills/crazyswami-wp-playground/manifest 已簽名 lockfile GET /api/skills/crazyswami-wp-playground/lockfile

測試它

正在使用「wp-playground」。 建立一個用於 plugin 測試的暫時網站。

預期結果:

一份設定計畫，包含選定版本、必要 plugins、啟動方式、測試步驟與清理注意事項。

正在使用「wp-playground」。 準備 WooCommerce 客戶示範。

預期結果:

一份示範檢查清單，涵蓋商店設定、theme 選擇、必要 extensions、範例內容與分享方式。

正在使用「wp-playground」。 執行前檢閱 Playground command。

預期結果:

一份風險摘要，標記 npm execution、mounted folders、remote blueprints 與更安全的替代方案。

安全審計

中風險
v8 • 2026/7/5 開啟版本化報告

Most static hits are Markdown formatting or official WordPress Playground documentation URLs, and the hidden ~/.claude path is a false positive. Confirmed risks are expected but meaningful: npx CLI execution, WordPress plugin/theme installation, PHP or WP-CLI blueprint steps, remote blueprint loading, and broad local directory mounting.

3
已掃描檔案
519
分析行數
16
複核項目
0
已忽略的誤報

已確認的安全問題 (2)

中
SKILL.md:55-66SKILL.md:245-246
Remote Blueprint Trust Warning Missing
The skill shows loading a remote blueprint URL while documenting blueprint steps that can run PHP, run WP-CLI, and write files. Users need an explicit warning to review remote blueprints before use.
The remote blueprint URL example is clear, and the same file lists powerful blueprint steps. The issue is missing trust guidance, not hidden malicious intent.
中
SKILL.md:197-198SKILL.md:213-220SKILL.md:306-308
Broad Local Directory Mounting Warning Missing
The skill recommends auto-mounting the current directory and mounting local plugin or theme paths without warning users to avoid secrets or broad project roots.
The mount commands and auto-mount workflow are explicit. The risk depends on the working directory contents, so confidence is high but not absolute.
能力複核項目 (16)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

中
SKILL.md:19-28
Ruby/shell backtick execution
```bash
The bash block advises running npx @wp-playground/cli, which can download and execute an npm package and start a local server. This is expected functionality but still external command execution.
中
SKILL.md:59
Ruby/shell backtick execution
| `installPlugin` | Install plugin from wp.org | `{"step":"installPlugin","pluginData":{"resource":"
The table documents installing WordPress plugins from wp.org, which can introduce third-party PHP code into the Playground site. It is legitimate but should be treated as supply-chain execution in a sandbox.
中
SKILL.md:60
Ruby/shell backtick execution
| `installTheme` | Install theme from wp.org | `{"step":"installTheme","themeData":{"resource":"word
The table documents installing themes from wp.org, which can introduce third-party code into the Playground site. The action is sandboxed but still executes external WordPress code.
中
SKILL.md:63
Ruby/shell backtick execution
| `runPHP` | Execute PHP code | `{"step":"runPHP","code":"<?php echo 'Hello'; ?>"}` |
The runPHP blueprint step executes PHP code inside the WordPress Playground environment. It is sandboxed, but untrusted blueprint code would still run during setup.
中
SKILL.md:64
Ruby/shell backtick execution
| `wp-cli` | Run WP-CLI command | `{"step":"wp-cli","command":"plugin list"}` |
The wp-cli blueprint step runs WordPress CLI commands inside the Playground environment. It is expected functionality but can change site state or install code when used with untrusted input.
中
SKILL.md:65
Ruby/shell backtick execution
| `writeFile` | Create/modify file | `{"step":"writeFile","path":"/index.html","data":"content"}` |
The writeFile blueprint step can create or modify files in the Playground filesystem. The risk is limited unless directories are mounted, but it is still a file-changing action.
中
SKILL.md:76-116
Ruby/shell backtick execution
```json
The documented development blueprint installs and activates multiple WordPress plugins from wp.org. This is normal for the skill, but it executes third-party plugin code in the test environment.
中
SKILL.md:120-142
Ruby/shell backtick execution
```json
The WooCommerce blueprint installs and activates a plugin and theme from wp.org. This is expected demo setup but introduces external WordPress code into the environment.
中
SKILL.md:146-173
Ruby/shell backtick execution
```json
The theme development blueprint installs a theme and plugins from wp.org. This is expected but still loads external WordPress code into the Playground environment.
中
SKILL.md:181-199
Ruby/shell backtick execution
```bash
The bash examples run npx @wp-playground/cli and include auto-mounting the current directory. This can execute npm code and expose local files to the Playground server.
中
SKILL.md:203-209
Ruby/shell backtick execution
```bash
The bash block runs npx @wp-playground/cli to build and serve snapshots. This is legitimate but still invokes external CLI code on the host.
中
SKILL.md:213-221
Ruby/shell backtick execution
```bash
The bash block mounts local plugin or theme directories into the Playground server. This can expose or modify local project files if used on the wrong path.
中
SKILL.md:255-279
Ruby/shell backtick execution
```javascript
The JavaScript API example runs a wp-cli step inside Playground. This is sandboxed but shows programmatic command execution in the WordPress environment.
中
SKILL.md:288-308
Ruby/shell backtick execution
2. Run `npx @wp-playground/cli server --blueprint=./test-blueprint.json`
The workflow tells users to run npx @wp-playground/cli with a blueprint file. That invokes external CLI code and executes blueprint steps, so review is required.
中
SKILL.md:308-347
Ruby/shell backtick execution
1. Use `--auto-mount` to mount current directory
The workflow advises --auto-mount for the current directory. This can expose more local files than intended if run from a broad project root.
低
SKILL.md:246
Hardcoded URL
https://playground.wordpress.net/?blueprint-url=https://example.com/blueprint.json
The example teaches loading a remote blueprint URL, and blueprints can include setup actions such as PHP, WP-CLI, and file writes. This is legitimate but should warn users to trust the remote source.

風險因素

🌐 網路存取 (14)
blueprints/base.json:2 blueprints/woocommerce.json:2 SKILL.md:15 SKILL.md:40 SKILL.md:78 SKILL.md:122 SKILL.md:148 SKILL.md:231 SKILL.md:234 SKILL.md:237 SKILL.md:240 SKILL.md:243 SKILL.md:246 SKILL.md:336
⚙️ 外部命令 (33)
SKILL.md:19-28 SKILL.md:28-38 SKILL.md:38-53 SKILL.md:53-59 SKILL.md:59 SKILL.md:60 SKILL.md:61 SKILL.md:62 SKILL.md:63 SKILL.md:64 SKILL.md:65 SKILL.md:66 SKILL.md:76-116 SKILL.md:116-120 SKILL.md:120-142 SKILL.md:142-146 SKILL.md:146-173 SKILL.md:173-181 SKILL.md:181-199 SKILL.md:199-203 SKILL.md:203-209 SKILL.md:209-213 SKILL.md:213-221 SKILL.md:221-229 SKILL.md:229-247 SKILL.md:247-255 SKILL.md:255-279 SKILL.md:279-288 SKILL.md:288-308 SKILL.md:308-347 SKILL.md:347-349 SKILL.md:349-350 SKILL.md:350-351
📁 檔案系統存取 (2)
SKILL.md:347 SKILL.md:347
審計單位: codex 檢視審計紀錄 →
分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告
安全評估

複製報告連結

https://skillstore.io/skills/crazyswami-wp-playground/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/crazyswami-wp-playground/security.svg)](https://skillstore.io/skills/crazyswami-wp-playground?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/crazyswami-wp-playground?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/crazyswami-wp-playground/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/crazyswami-wp-playground.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
學術引用 (APA · BibTeX · CFF)

APA 引用

CrazySwami. (2026). wp-playground security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/crazyswami-wp-playground/audits/8

BibTeX 引用

@techreport{crazyswami-crazyswami-wp-playground-2026, author = {CrazySwami}, title = {wp-playground security audit report (audit version 8)}, institution = {Skillstore}, year = {2026}, number = {8}, url = {https://skillstore.io/skills/crazyswami-wp-playground/audits/8}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "wp-playground security audit report (audit version 8)" version: "unspecified" type: report authors: - name: "CrazySwami" date-released: "2026-07-05" url: "https://skillstore.io/skills/crazyswami-wp-playground/audits/8" identifiers: - type: other value: "skillstore:crazyswami-wp-playground:audit:8" description: "Skillstore immutable audit report identifier"

比較變體

2 個可安裝變體

每位作者的技能都保留為獨立的可安裝項目。推薦變體依 Skillstore 證據排序。

為何此變體排名第一

Skillstore 評分最高
Automattic 推薦

automattic-wp-playground

Skillstore 評分 66
證據置信度 高
Skillstore 使用量 14
已更新

2026-10-25

CrazySwami 目前

crazyswami-wp-playground

Skillstore 評分 50
證據置信度 高
Skillstore 使用量 12
已更新

2026-09-09

Skillstore 評分

評分依據 證據置信度: 高
55
架構
85
可維護性
87
內容
71
社群
83
規範符合度

你可以打造什麼

執行 Plugin Smoke Tests

建立一個可拋棄的網站，安裝 plugin，測試關鍵畫面，並在檢閱後關閉環境。

準備 WooCommerce 示範

使用 WooCommerce、Storefront、SEO 工具與基本商店設定，啟動一個暫時商店。

預覽 Theme 變更

掛載本機 theme 資料夾，並在瀏覽器中檢查變更，而不需要完整伺服器堆疊。

試試這些提示

啟動乾淨的測試網站 
使用 wp-playground skill 啟動一個基本 WordPress Playground 網站。除非我要求 CLI，否則請選擇瀏覽器存取。
建立 Plugin 測試 Blueprint 
建立一份用於測試 [plugin slug] 的 WordPress Playground blueprint 計畫。包含版本、登入行為、plugins 與網站選項。
準備 WooCommerce 示範 
使用 WooCommerce blueprint pattern 規劃一個暫時商店示範。包含 plugins、theme 選擇、商店設定與示範步驟。
檢閱 Playground 工作流程 
在我執行之前稽核這個 Playground command 或 blueprint：[paste details]。識別 network access、mounted paths 與不安全的步驟。

最佳實務

  • 執行前檢閱每個 blueprint，尤其是 runPHP、wp-cli、writeFile 與 remote blueprint URLs。
  • 掛載本機程式碼時，使用最小化的測試目錄。
  • 重現 bug 時，固定 WordPress、PHP、plugin 與 CLI 版本。

避免

  • 不要從不信任的來源載入 remote blueprints。
  • 不要自動掛載包含 secrets 或 private data 的專案根目錄。
  • 不要將 Playground 效能或 email 行為視為與 production 等同。

常見問題

此技能需要 Docker 嗎？
不需要。WordPress Playground 可在瀏覽器中執行，或透過 Playground CLI 執行，不需要 Docker stack。
它可以測試 WooCommerce 嗎？
可以。此技能包含 WooCommerce blueprint pattern，搭配 WooCommerce、Storefront、SEO 工具與商店設定。
它會執行本機 commands 嗎？
它可以引導使用 npx 的 CLI commands。執行前請檢閱每個 command。
網站資料會保留嗎？
預設不會。需要可重複狀態時，請匯出 snapshot 或使用已儲存的環境。
它可以使用本機 plugin 或 theme 檔案嗎？
可以。CLI 範例會掛載本機目錄，因此請使用不含 secrets 的有限資料夾。
這適合 production sites 嗎？
不適合。請將它用於測試、示範與暫時預覽，而不是 production hosting。

開發者詳細資訊

作者

CrazySwami

授權

MIT

Skillstore 修訂

r1

版本提示

作者未聲明版本。

儲存庫

https://github.com/CrazySwami/wordpress-dev-skills/tree/main/skills/wp-playground

引用

02f077c174c5335e2f5d02ca15e77b70d9543e58

維護新鮮度

2026/7/18

使用量

4 次下載 · 278 次瀏覽

檔案結構

📁 blueprints/

📄 base.json

📄 woocommerce.json

📄 SKILL.md

CrazySwami 的更多技能

查看全部

相關技能

查看全部