Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jianshuo/claude-skills --skill wjs-converting-wp-to-hugogit clone --depth 1 https://github.com/jianshuo/claude-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jianshuo/claude-skills/wjs-converting-wp-to-hugo)<a href="https://agentmods.dev/skills/jianshuo/claude-skills/wjs-converting-wp-to-hugo"><img src="https://agentmods.dev/badge/skills/jianshuo/claude-skills/wjs-converting-wp-to-hugo/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jianshuo/claude-skills/wjs-converting-wp-to-hugo"><img src="https://agentmods.dev/badge/skills/jianshuo/claude-skills/wjs-converting-wp-to-hugo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00113 | $0.03313 |
| Opus 5 | $0.00056 | $0.01656 |
| Sonnet 5 | $0.00023 | $0.00663 |
| Haiku 4.5 | $0.00011 | $0.00331 |
Grade A, and why
wjs-converting-wp-to-hugo scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 192 lines — stays where its author put it; the contents beside it link to each section on GitHub.
wjs-converting-wp-to-hugo
把任意 WordPress 站迁成 Hugo + Markdown + git 静态站,部署到 GitHub Pages。 输入只需两样,全程离线、零第三方依赖:
- WXR 导出 — WordPress 后台
工具 → 导出 → 所有内容得到的*.xml(包含全部文章/页面/分类/标签的 HTML 正文)。 uploads/文件夹 — 站点的wp-content/uploads/(按年/月分目录的图片与附件)。
产出:content/*.md + static/wp-content/uploads/ + 手写极简主题,Hugo 构建,GitHub Actions 发布。
全站 URL 保持 /archives/<数字>/ 不变,老链接 100% 不断。
When to use
- 用户有一个 WordPress 站,想去掉动态/评论/数据库,改成 git + Markdown 维护。
- 用户提供了 WXR
.xml和uploads/(或能拿到)。 - 老链接必须保留(SEO / 外部引用)。
When NOT to use
- 没有 WXR,只有线上站 → 先在 WP 后台导出,或用 REST API 拉 JSON(本 skill 走 WXR,更可移植)。
- 要保留评论/会员/搜索等动态功能 → 静态站做不了,不适用。
- 站点极小(几篇)→ 手抄更快。
Core principle
WXR 是唯一真相源,uploads/ 直接当静态资源。
图片不下载、不改名:把 uploads/ 拷进 static/wp-content/uploads/,正文里的图片 URL 改成 根相对 /wp-content/uploads/... 即可原地解析。文章 URL 从 <link> 原样保留。转换器是纯函数 + 单元测试,先测后写。
Pipeline
WXR .xml + uploads/ → wxr_to_hugo.py → content/*.md + static/wp-content/uploads/ → hugo build → GitHub Actions → Pages
Two decisions you MUST ask the user (do not silently decide)
WordPress 里有两类内容静态站处理不了,必须问用户,别擅自发布:
- 密码保护文章(
<wp:post_password>非空)。静态站无密码门 → 发布就是公开。 选项:排除(默认,最安全,URL 会 404)/ 公开发布 / 转成draft。 核对计数务必用 ElementTree(即parse_items),别用裸 grep:<wp:post_password>的值是 CDATA 包裹的(<![CDATA[secret]]>),grep '<wp:post_password>[^<]*</...>'会把每条都当空 → 误报「0 篇密码文章」漏掉真有密码的文章(maggiacito.com 实战,差点漏发 1 篇)。 - WordPress 脚手架页(
sample-page、login/register/findpassword等插件短代码页、空页、登录设计器预览页)。 默认排除——它们不是内容。is_real_page()已按「空正文 / 单条短代码 / 默认 slug 黑名单」过滤。
转换器对这两类都已实现排除;用 AskUserQuestion 确认后再跑全量。
Steps
1. 放好输入,建工程
mkdir -p ~/code/<site> && cd ~/code/<site> && git init
# 把 WXR 拷进来(注意:WXR 含密码文章正文 + 作者邮箱,勿提交!见「安全」)
cp /path/to/<site>.WordPress.*.xml .
# uploads/ 放到工程根(含子目录 年/月)。注意它可能含 wordpress_db.sql —— 勿提交!
cp -R /path/to/uploads ./uploads
mkdir -p scripts tests content/posts layouts/_default layouts/partials static
What ships with it
13 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/gitignore 382 B
- assets/hugo.toml 929 B
- assets/layouts/_default/archives.html 359 B
- assets/layouts/_default/baseof.html 947 B
- assets/layouts/_default/list.html 439 B
- assets/layouts/_default/single.html 736 B
- assets/layouts/_default/terms.html 263 B
- assets/layouts/index.html 312 B
- assets/layouts/partials/style.html 2.0 KB
- assets/workflow-hugo.yml 1016 B
- scripts/verify_build.py 1.1 KB runs code
- scripts/wxr_to_hugo.py 13 KB runs code
- tests/test_wxr.py 10 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 192 lines · 113 tokens per session scan A 477a7ddc4103
wjs-converting-wp-to-hugo is a skill published in the GitHub repository jianshuo/claude-skills (129 stars, last pushed 23d ago), licensed MIT. It adds 113 tokens to every session and 3,313 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
release-skills
A release workflow for preparing and publishing a new version of a software project. A release is a named version that may include updated version files, release notes, tags, or a GitHub Release.
version-release
Choose and apply the correct semantic version bump for this repository. Use for every user-visible release, before merge when a change set should ship as patch, minor, or major, and whenever package/plugin/desktop version metadata must stay synchronized.
changelog-gen
A changelog generator that turns Git history into a version-by-version record of project changes. A changelog is a readable summary of new features, fixes, breaking changes, documentation, and other updates.
publish
Publish oh-my-opencode to npm by triggering the GitHub Actions publish workflow and verifying its artifacts. Ship-only: never runs pre-publish-review or re-reviews merged code unless the user explicitly asks. Argument: . Triggers: publish, release, deploy, npm publish.
pre-publish-review
Nuclear-grade 12-agent pre-publish release gate. Runs /get-unpublished-changes to detect all changes since last npm release, spawns up to 10 ultrabrain agents for deep per-change analysis, invokes /review-work (orchestrator manual QA plus one gate reviewer) for holistic review, and 1 oracle for overall release…
release
CONTRIBUTOR TOOL - Cut a plugin release: bump plugin.json version, finalize CHANGELOG, update README if needed, gate on make ci, commit, tag vX.Y.Z, and create the GitHub release. Use when shipping a new plugin version. NOT distributed.