📦 WordPress REST API — 管理WP内容
v1.0.0通过纯 HTTP 调用，一键完成 WordPress 文章、页面、分类、标签、用户等全量 REST API 操作，支持自定义请求，轻松集成自动化工作流。
7· 4.0k·23 当前·23 累计
by @codedao12下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do exactly what it says: a Node CLI that talks to a WordPress site via its REST API. Before installing or running it: 1) Confirm the WP_BASE_URL you supply is correct and points to a site you control or trust. 2) Use a dedicated, low-privilege WordPress account (Application Password) for automation and avoid giving admin credentials if not needed. 3) The registry metadata incorrectly states there are no required env vars — expect to set WP_BASE_URL and one of the credential...详细分析 ▾
ℹ 用途与能力
Name/description, SKILL.md, package.json, and scripts/wp-cli.js all describe a WordPress REST API CLI and the code implements exactly that. However, the registry metadata claims ‘Required env vars: none’ while the SKILL.md and code require WP_BASE_URL (and optionally WP_BASIC_TOKEN, WP_USER/WP_APP_PASSWORD, or WP_JWT_TOKEN). This is an inconsistency in metadata, but the requested envs are appropriate for the stated purpose.
✓ 指令范围
SKILL.md instructions and the CLI script confine actions to constructing HTTP requests against a user-provided WordPress base URL and reading optional local JSON files (for bodies). There are no instructions to read unrelated system files, call external endpoints other than the specified WP_BASE_URL, or collect arbitrary credentials.
✓ 安装机制
There is no platform-level install spec (lowest risk). The bundle contains package.json and instructs running npm install and node scripts/wp-cli.js; that is consistent with a Node CLI. No downloads from untrusted URLs or extract/install steps are present.
ℹ 凭证需求
The code expects WP_BASE_URL and optional WP credentials (basic token, username+app password, or JWT). Those are proportionate for a WordPress CLI. The only issue is the registry metadata omits these required env vars — the omission could mislead users into thinking no credentials are needed.
✓ 持久化与权限
The skill does not request persistent or elevated platform privileges (always is false). It does not modify other skills or system-wide settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/2
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install wordpress
镜像加速npx clawhub@latest install wordpress --registry https://cn.longxiaskill.com