All notable changes to the siteagent-elementor-studio skill kit are documented here.
The format is loosely based on Keep a Changelog,
and the kit is versioned via the version: field in files/SKILL.md.
- Committed
.mcp.json(secrets as placeholders only) — theelementorconnection now comes up from env vars alone:WP_URL/WP_USERNAME/WP_APP_PASSWORD(the same triowordpress-api-proreads) drive the@msrbuilds/emcp-proxybridge vianpx. claude.ai cloud environments (which load the repo's.mcp.jsonfrom the clone and inject env vars from the environment config) and devices with the vars in their shell get the Elementor tools with no per-machine setup. The${VAR:-}defaults keep the config parseable when the vars are unset — the connection then just shows as unavailable until they're provided (a bare unset${VAR}would fail the whole config parse, per the Claude Code docs — Codex round-1 P2). Real credentials never enter the tracked file..claude/settings.jsonsetsenableAllProjectMcpServersso the committed config is auto-approved once the folder is trusted — untrusted checkouts deliberately ignore the committed key (v2.1.196+) and prompt once. - The proxy launch is version-pinned (
@msrbuilds/emcp-proxy@1.9.1), not@latest— the config is auto-approved and receives WordPress credentials, so an unpinned latest would be a standing supply-chain risk; bump the pin deliberately (Codex round-1 P1). - Both
.mcp.jsonwriters now refuse to write credentials into a tracked placeholder config (Codex round-1 + round-2 P2): the interactive wizard, run inside this repo's checkout, would previously have untracked the committed config (git rm --cached) and replaced it with a real-credential file; the non-interactivenew-client.sh(--project-dirat a checkout) would have overwritten it outright, putting the Basic-auth credential straight intogit diff. Both now detect the tracked placeholder ("WP_URL": "${WP_URLmarker +git ls-files) and point to the env-var route or a separate per-site project directory; everywhere else they keep writing the git-ignored per-project config as before. - Honest wizard outcome + first-session routing for the placeholder case (Codex
round-3 P2s): when the interactive wizard skips the write because of the tracked
placeholder, it no longer prints "Setup complete → approve the server" (nothing was
configured — credentials lived only in shell variables); it now ends with the exact
export WP_URL/WP_USERNAME/WP_APP_PASSWORDlines to finish the connection, and stops suggesting a Basic-auth config to paste. SKILL.md's first-session predicate no longer treats the mere existence of.mcp.jsonas a connection — a placeholder config with unset env vars routes to the env-var fix or a separate per-site directory.
- First-session setup now resolves
setup-elementor-mcp.shfrom the loaded skill's own directory (plugin/marketplace installs bundle it there), with~/.claude/scripts/setup-elementor-mcp.shkept as the manual-install fallback — plugin users previously hit "file not found" because onlyINSTALL.shcreates the home-directory copy. README cross-references clarified to match.
- Reconcile the
detect-elementor-versionguidance infiles/SKILL.md: the Pro-detection section no longer tells the agent the tool "errors in v1.5.0" / "the buggy version tool" — that schema bug is fixed on current builds (as the Setup-gotchas + call-it sections already stated). The tool-presence check remains the definitive Pro-vs-Free signal;detect-elementor-versionis usable but reports atomic/version support, not a Pro flag. Removes the internal contradiction. No skill-behavior change.
- Refresh
references/engine-and-premium.md(and the SKILL.md engine line) to current facts: the fork is v1.24.0, up to 118 tools, and — since v1.22.0 — carries no Freemius / no hosted marketplace / no phone-home. Corrects the stale "v1.9.0 / 94 tools / Freemius auto-update" text, documents the v1.13–v1.24 capability surface (design-system CRUD, governed page + design-token writes, schema-in-error, numeric-range hints), and updates the fork-vs-upstream-Premium (emcp-pro3.0.0) comparison. No skill-behavior change.
Capability upgrade — teaches the fork's v1.14–v1.23 contract surface (all claims source-verified against Digitizers/elementor-mcp). Four additions:
- Responsive value rules. New "Responsive values" section in
SKILL.md: classic widgets take per-breakpoint values as suffixed keys (typography_font_size_tablet,align_mobile) on the same base control with the same value shape; the suffix set is breakpoint-dependent (derives from Elementor's active breakpoints —_tablet/_mobileplus_widescreen/_laptop/custom, not a fixed list). Atomic (V4) responsive is variants, not suffixes — documented inreferences/atomic-v4.md. settings.classeswiring for atomic local styles.references/atomic-v4.mdnow explains the two coupled pieces — the typedsettings.classesreference list and the separate top-levelstylesmap that defines each class — the rule that every class id must resolve (local style def or Global Classg-id), that the localstylesmap is built at creation (add-atomic-*/add-flexbox/ the universaladd-atomic-widget), and thatupdate-atomic-widgetmergessettingsonly — it can changesettings.classesreferences but cannot write thestylesmap, so restyle by recreating or via a Global Class.- New
references/v3-to-v4-conversion.md— rebuilding a classic (V3) design on the atomic (V4) engine: the classic→atomic tool map, never-mix rule,$$typeenvelope cross-reference, styling parity (local styles vs. Global Classes / Variables), a worked hero example, and a conversion checklist. - New v1.14–v1.23 fork surface. New
references/design-system-crud.mddocuments the Elementor 4 design-system CRUD tools — Global Classes (create-/update-/delete-/apply-global-class), Variables (list-/get-/create-/edit-/delete-/restore-variable), and Interactions (list-/add-/edit-/delete-interaction), calling outrestore-variable+edit-interactionas fork-superset capabilities, with Pro gating, caps, and permissions. Newreferences/error-recovery.mdcovers governance errors (governance_grant_required/_grant_invalid/_render_failed/_rollback_failed— all opt-in, with retry semantics), schema-in-error recovery loops (invalid_widget_type/widget_not_foundinline suggestions; atomicsave_rejectedinline prop schema), andget-widget-schemanumeric range hints (minimum/maximum/multipleOf, slider unit enums).SKILL.mdgains focused sections linking out to all three.
- Fix the skill's H1 title in
files/SKILL.md(# Elementor Pro Studio Skill→# SiteAgent Elementor Studio Skill) — a leftover from before the rename that ClawHub renders as the listing header. Also aligns the ClawHub publish display name to "SiteAgent Elementor Studio". No functional change.
- Renamed:
claude-elementor-pro→siteagent-elementor-studio. The kit's brand tokens (repo name, install URLs, README title) and the skill's own invocation name (elementor-pro-studio→siteagent-elementor-studio) are rebranded, avoiding the trademark overlap of a name that stacked "Claude" and "Elementor Pro" (Elementor's flagship product). Descriptive references — "for Claude Code", Anthropic attribution, Elementor Pro-compatibility badges, and theemersimeon/claude-elementor-kitupstream credit — are unchanged (nominative/descriptive use). - Upgrade note (1.1.x → 1.2.0): the skill now installs to
~/.claude/skills/siteagent-elementor-studioand is invoked as/siteagent-elementor-studio(previouslyelementor-pro-studio).INSTALL.sh/INSTALL.ps1detect and offer to remove the priorelementor-pro-studio(and olderelementor-mcp) skill directories so Claude doesn't load two copies. The old GitHub URL redirects.
Security hardening (ClawHub audit — siteagent-elementor-studio 1.1.1):
- Read the WordPress application password silently (
read -rs) so it no longer echoes to the terminal. - Removed the username-enumeration fallback on auth failure (generic error instead).
- Declared the skill's shell/network/filesystem/env permissions in SKILL.md; noted shell/setup runs only on explicit confirmation.
.mcp.jsoncredential file is now git-ignored on write with a rotation/least-privilege warning.- Framed companion tooling (content/SEO/media/ACF/Woo) as optional, opt-in, separately-credentialed.
- Added an optional
EMCP_PIN_VERSIONto pin the plugin release (default remains latest from the trusted Digitizers fork over HTTPS).
- Point all operational references at our fork
Digitizers/elementor-mcp(the Elementor 4.x-correct engine the skill drives); msrbuilds/elementor-mcp is retained as end-credit attribution only. - Fix the post-install prompt to say
/siteagent-elementor-studio(was still/elementor-mcp). publish-clawhub.ymldry-run now calls the realclawhub skill publish --dry-run(confirmed a genuine CLI flag) instead of just echoing the command.
- Renamed the skill's invocation name to
siteagent-elementor-studio(OpenClaw-neutral) and published to ClawHub under "Elementor Pro Studio". The GitHub repo remainssiteagent-elementor-studio. - Added a ClawHub publish workflow.
Addresses Codex review findings across the installers and reference docs.
new-client.sh(HIGH): live-host onboarding now copies the plugin zip to a durable path ($PROJECT_DIR, else$HOME) before aborting. TheEXITtrap (rm -rf "$WORK") previously deleted the zip the instant the script aborted, so the printed upload instructions pointed at an already-gone file.references/recipes.mdFAQ (HIGH): dropped the "a mixed page is fine" guidance, which contradicted the never-mix rule (a classic accordion on a V4/atomic page does not persist). The div-block +<details>atomic pattern is now the only documented V4 path for the FAQ recipe.new-client.sh(MED): a local plugin-install failure is now fatal (abort), and the route check is fatal after an attempted install — no more false "Client ready" with a broken.mcp.json.setup-elementor-mcp.sh(MED): the MCP install step now supports Linux Local data roots (~/.config/Local,~/.local/share/Local) and app-resource paths, falling back to a clear manual-upload flow when the bundled WP-CLI toolchain can't be located — instead of resolving the site then aborting on macOS-only paths.setup-elementor-mcp.sh(MED): reinstall no longer skips solely because a genericmcpnamespace is present. It now detects the oldmcp-adapter+ upstreamelementor-mcppair (standalone adapter plugin, or a pre-fork version) and offers to (re)install the bundled Digitizers fork over it.setup-elementor-mcp.sh(P1, Codex follow-up): accepting that (re)install no longer just warns and installs the fork on top of the old setup. A newremove_pluginhelper deactivates + deletes the standalonemcp-adapterplugin via REST and re-verifies (viarefresh_plugins_json+plugin_is_installed) that it's actually gone before the fork install proceeds. If REST removal fails, the script pauses in a recheck loop (or aborts on request) instead of ever installing the bundled fork alongside the still-present standalone adapter — which would double-load the MCP transport and break the route.references/recipes.mdContact (MED): added an*Atomic/V4*variant — a Fluent Forms shortcode dropped viaadd-atomic-widget, flagging that the native Pro Form widget isn't V4-ready.references/atomic-v4.md(LOW): clarified that "pass simple flat values" applies to the dedicated atomic helper tools; the universaladd-atomic-widget/update-atomic-widgetescape hatch needs raw$$type-shaped settings (flat values there are saved as empty/ignored).setup-elementor-mcp.sh+new-client.sh(LOW): a leading~in a resolved Local path fromsites.jsonis now expanded to$HOMEbefore thewp-config.phpprobe, which otherwise looked for a literal~/...directory and aborted.
- Initial release of the SiteAgent Elementor Studio skill kit.