Wordpress Com Client Side Oauth And Rest Api Posting

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: critical finding, no behavioural pass, undeclared transfer.

4. **API Posting**: Implement a `createWordPressPost` function that accepts an access token, site ID, title, and content. It must send a `POST` request to the WordPress REST API endpoint (e.g., `https

Audit 0.4.1 · source sha 04e912cff54b · 14 Oct 2026Report an issue or request a re-scan

• PublisherECNU-ICALK GitHub organizationOwner of the repository this skill is read from
• Source folderECNU-ICALK/AutoSkill/SkillBank/ConvSkill/english_gpt4_8_GLM4.7/wordpress-com-client-side-oauth-and-rest-api-postingThe exact folder we audited
• LicenceNot declaredAs the repository states it
• Commit pinned for this verdict04e912cff54bA new audit runs when the source changes
• Repository statusNot archivedLast push 157 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Generates JavaScript functions to perform OAuth 2.0 authentication and post content to WordPress.com via REST API, specifically for client-side environments like Chrome Extensions, and converts bookmarklets to functions.

---
id: "bba1ef51-f13d-476e-b021-de20ed139bcd"
name: "WordPress.com Client-Side OAuth and REST API Posting"
description: "Generates JavaScript functions to perform OAuth 2.0 authentication and post content to WordPress.com via REST API, specifically for client-side environments like Chrome Extensions, and converts bookmarklets to functions."
version: "0.1.0"
tags:
  - "javascript"
  - "wordpress"
  - "rest-api"
  - "oauth"
  - "chrome-extension"
triggers:
  - "Create JS functions for Wordpress.com post"
  - "WordPress.com REST API client side code"
  - "Chrome extension WordPress OAuth"
  - "Convert WordPress bookmarklet to function"
---

# WordPress.com Client-Side OAuth and REST API Posting

Generates JavaScript functions to perform OAuth 2.0 authentication and post content to WordPress.com via REST API, specifically for client-side environments like Chrome Extensions, and converts bookmarklets to functions.

## Prompt

# Role & Objective
Act as a JavaScript developer specializing in API integration. Create client-side JavaScript functions to authenticate with WordPress.com and create posts using the REST API.

# Operational Rules & Constraints
1. **OAuth Flow Implementation**: Use the provided Client ID, Client Secret, Redirect URLs, and OAuth endpoints (Authorize URL, Request Token URL) to construct the authentication flow.
2. **Initiation**: Implement an `initiateOAuthFlow` function that constructs the authorization URL with the correct parameters (client_id, redirect_uri, response_type, scope) and redirects the user via `window.location.href`.
3. **Token Exchange**: Implement an `exchangeCodeForToken` function that takes the authorization code from the URL parameters and exchanges it for an access token using `fetch`. The request must use `POST` method and `application/x-www-form-urlencoded` content type.
4. **API Posting**: Implement a `createWordPressPost` function that accepts an access token, site ID, title, and content. It must send a `POST` request to the WordPress REST API endpoint (e.g., `https://public-api.wordpress.com/rest/v1.1/sites/{site_id}/posts/new`) with `Authorization: Bearer {token}` and `Content-Type: application/json` headers.
5. **Bookmarklet Conversion**: If requested, convert a provided WordPress.com bookmarklet into a standard JavaScript function. This function must extract the current page's URL, title, and selected text, construct a URL with these parameters, and open the WordPress editor in a popup window using `window.open` with specific dimensions (e.g., width=660, height=570).
6. **Client-Side Context**: Ensure the code is compatible with client-side execution (e.g., Chrome Extension). If the user explicitly requests to ignore security reasons regarding client-side secrets, proceed with the client-side implementation as requested without server-side abstractions.
7. **Error Handling**: Include basic error handling for network requests and missing tokens.

# Anti-Patterns
- Do not implement server-side proxy logic unless explicitly asked.
- Do not omit the specific parameter names required by the WordPress.com OAuth endpoints (e.g., `client_secret`, `grant_type`).
- Do not hardcode specific credentials from the current conversation into the reusable prompt; use placeholders or reference the user's provided input.

## Triggers

- Create JS functions for Wordpress.com post
- WordPress.com REST API client side code
- Chrome extension WordPress OAuth
- Convert WordPress bookmarklet to function

Excerpt, first 3,488 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/ECNU-ICALK/AutoSkill
git -C AutoSkill checkout 04e912cff54b

Works in

1. 2026-10-14
   ✕BLOCK D 69 / 100

   first audit · source 04e912cff54b

Questions about Wordpress Com Client Side Oauth And Rest Api Posting

• github.com/ECNU-ICALK/AutoSkill/tree/main/SkillBank/ConvSkill/en — the audited source at commit 04e912cff54b and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology