How do I install the Wordpress skill?

Run npx skillmds@latest add xclouddev/wordpress in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Wordpress safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Wordpress?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Wordpress free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Wordpress?

xCloudDev (@xclouddev) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Wordpress by xclouddev — Agent Skill

Name: Wordpress
Author: xCloudDev

Wordpress

Manage WordPress on xCloud sites — list/update/activate plugins and themes, check WordPress health and update summaries, toggle WP_DEBUG, generate magic-login URLs, run vulnerability scans and manage findings, and run PageSpeed Insights scans. Use for WordPress app management, security scans, or site performance. For SSL see xcloud:ssl; for site backups/domains/cache see xcloud:sites; for server infra see xcloud:servers.

xCloudDev Updated Sep 22, 2026

File contents

xCloud WordPress

Owns WordPress app management plus site vulnerability scanning and PageSpeed. Read the shared layer first for auth, base URL, and conventions:

${CLAUDE_PLUGIN_ROOT}/reference/auth.md
${CLAUDE_PLUGIN_ROOT}/reference/conventions.md
${CLAUDE_PLUGIN_ROOT}/reference/mcp.md — prefer the MCP tools when connected: sites_wordpress_* (plugins/themes/updates/status/update/ activate/refresh), sites_vulnerabilities_*, vulnerabilities_index (team-wide), sites_pagespeed_*, sites_wp-debug, sites_magic-login; the $XC calls below are the REST fallback.

XC="${CLAUDE_PLUGIN_ROOT}/scripts/xcloud.sh"

Scopes: reads need read:sites, writes need write:sites.

Response format

Brand every user-facing reply (see reference/conventions.md → Response format): open with ☁️ **xCloud · WordPress** — <site domain>, give the trimmed result, and close with a _via xcloud:wordpress_ line.

Narrate each call (see Progress narration): before every $XC call print one line of what xCloud is doing, e.g. ☁️ xCloud is scanning \` for vulnerabilities…; the first call of a task opens with ☁️ xCloud is starting a session…. **Every progress line and every action sentence must start with xCloudas the actor — never a bare verb like "Scanning…" or "Updating…". SayxCloud is scanning…`.**

On the first xcloud reply in a conversation, lead with the xCloud startup banner (see reference/conventions.md → Startup banner) in a fenced code block — once per conversation.

Sub-resources (load on demand)

Sub-resource	Reference file
Plugins, themes, updates, activate, refresh	`reference/plugins-themes.md`
Vulnerabilities (scan, list, ignore)	`reference/vulnerabilities.md`
PageSpeed Insights	`reference/pagespeed.md`

Core endpoints

Operation	Method + path
WP health status	`GET /sites/{uuid}/wordpress/status`
Updates summary	`GET /sites/{uuid}/wordpress/updates`
Toggle WP_DEBUG	`POST /sites/{uuid}/wp-debug`
Magic login URL	`POST /sites/{uuid}/magic-login`

Not here: SSL → xcloud:ssl; backups/domains/cache/SSH → xcloud:sites; server infra → xcloud:servers.

Examples

WordPress health + pending updates:

SITE_UUID='replace-me'
"$XC" GET "/sites/$SITE_UUID/wordpress/status"  | jq '.data'
"$XC" GET "/sites/$SITE_UUID/wordpress/updates" | jq '.data'

Toggle WP_DEBUG (enabled required):

"$XC" POST "/sites/$SITE_UUID/wp-debug" '{"enabled":true}' | jq '.message'

Generate a one-time admin magic-login URL:

"$XC" POST "/sites/$SITE_UUID/magic-login" '{"login_as":"admin"}' | jq -r '.data.url // .data'

Cross-domain note

vulnerabilities and pagespeed are addressed at /sites/{uuid}/… and work on any site, but are owned here because they are predominantly WordPress concerns. A non-WordPress "scan my site" request still routes here via the xcloud:sites cross-link.

Pitfalls

Plugin/theme updates and activations are async and can optionally back up first — see reference/plugins-themes.md.
Magic-login URLs are single-use and short-lived; never log them.

---name: wordpressdescription: Manage WordPress on xCloud sites — list/update/activate plugins and themes, check WordPress health and update summaries, toggle WP_DEBUG, generate magic-login URLs, run vulnerability scans and manage findings, and run PageSpeed Insights scans. Use for WordPress app management, security scans, or site performance. For SSL see xcloud:ssl; for site backups/domains/cache see xcloud:sites; for server infra see xcloud:servers.---# xCloud WordPressOwns WordPress app management plus site vulnerability scanning and PageSpeed.Read the shared layer first for auth, base URL, and conventions:- `${CLAUDE_PLUGIN_ROOT}/reference/auth.md`- `${CLAUDE_PLUGIN_ROOT}/reference/conventions.md`- `${CLAUDE_PLUGIN_ROOT}/reference/mcp.md` — **prefer the MCP tools when connected**: `sites_wordpress_*` (plugins/themes/updates/status/update/ activate/refresh), `sites_vulnerabilities_*`, `vulnerabilities_index` (team-wide), `sites_pagespeed_*`, `sites_wp-debug`, `sites_magic-login`; the `$XC` calls below are the REST fallback.```bashXC="${CLAUDE_PLUGIN_ROOT}/scripts/xcloud.sh"```Scopes: reads need `read:sites`, writes need `write:sites`.## Response formatBrand every user-facing reply (see `reference/conventions.md` →**Response format**): open with `☁️ **xCloud · WordPress** — <site domain>`, givethe trimmed result, and close with a `_via xcloud:wordpress_` line.Narrate each call (see **Progress narration**): before every `$XC` call print oneline of what xCloud is doing, e.g. `☁️ xCloud is scanning \`<domain>\` forvulnerabilities…`; the first call of a task opens with`☁️ xCloud is starting a session…`. **Every progress line and every actionsentence must start with `xCloud` as the actor — never a bare verb like"Scanning…" or "Updating…". Say `xCloud is scanning…`.**On the **first** xcloud reply in a conversation, lead with the xCloud startupbanner (see `reference/conventions.md` → **Startup banner**) in a fenced codeblock — once per conversation.## Sub-resources (load on demand)| Sub-resource | Reference file ||---|---|| Plugins, themes, updates, activate, refresh | `reference/plugins-themes.md` || Vulnerabilities (scan, list, ignore) | `reference/vulnerabilities.md` || PageSpeed Insights | `reference/pagespeed.md` |## Core endpoints| Operation | Method + path ||---|---|| WP health status | `GET /sites/{uuid}/wordpress/status` || Updates summary | `GET /sites/{uuid}/wordpress/updates` || Toggle WP_DEBUG | `POST /sites/{uuid}/wp-debug` || Magic login URL | `POST /sites/{uuid}/magic-login` |**Not here:** SSL → `xcloud:ssl`; backups/domains/cache/SSH → `xcloud:sites`;server infra → `xcloud:servers`.## ExamplesWordPress health + pending updates:```bashSITE_UUID='replace-me'"$XC" GET "/sites/$SITE_UUID/wordpress/status" | jq '.data'"$XC" GET "/sites/$SITE_UUID/wordpress/updates" | jq '.data'```Toggle WP_DEBUG (`enabled` required):```bash"$XC" POST "/sites/$SITE_UUID/wp-debug" '{"enabled":true}' | jq '.message'```Generate a one-time admin magic-login URL:```bash"$XC" POST "/sites/$SITE_UUID/magic-login" '{"login_as":"admin"}' | jq -r '.data.url // .data'```## Cross-domain note`vulnerabilities` and `pagespeed` are addressed at `/sites/{uuid}/…` and work onany site, but are owned here because they are predominantly WordPress concerns.A non-WordPress "scan my site" request still routes here via the `xcloud:sites`cross-link.## Pitfalls- Plugin/theme updates and activations are async and can optionally back up first — see `reference/plugins-themes.md`.- Magic-login URLs are single-use and short-lived; never log them.

Frequently asked questions