accelerate-connect

Warn

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill's primary function is the collection, handling, and storage of WordPress application passwords and usernames.
  • It stores these credentials in ~/.config/accelerate-ai-toolkit/env and .claude/settings.local.json.
  • While it attempts to secure the files using chmod 600, the management of sensitive secrets within the agent context carries inherent risk.
  • [COMMAND_EXECUTION]: The skill utilizes the bash tool for several configuration and verification tasks:
  • Checks the system's npx binary path and version using command -v and npx --version.
  • Employs a Python script (python3 -c) to merge user-provided credentials into a JSON configuration file.
  • Creates directories and writes configuration files using mkdir, cat, and chmod.
  • Provides command snippets for the user to modify their shell startup profiles (e.g., .zshrc, .bashrc, or fish config) to persistently load environment variables.
  • [EXTERNAL_DOWNLOADS]: The skill uses curl to make network requests to a user-provided WordPress site root URL to verify the availability of specific REST API endpoints (/wp-json/accelerate/v1, /wp-json/mcp/mcp-adapter-default-server, and /wp-json/wp/v2/wpmcp).
  • [DATA_EXFILTRATION]: During the verification step, the skill sends the collected WordPress username and application password to the user-specified site URL using HTTP Basic Authentication via curl to confirm the credentials work before saving them.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 18, 2026, 03:34 AM
Security Audit — agent-trust-hub — accelerate-connect