accelerate-connect
Warn
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill's primary function is the collection, handling, and storage of WordPress application passwords and usernames.
- It stores these credentials in
~/.config/accelerate-ai-toolkit/envand.claude/settings.local.json. - While it attempts to secure the files using
chmod 600, the management of sensitive secrets within the agent context carries inherent risk. - [COMMAND_EXECUTION]: The skill utilizes the bash tool for several configuration and verification tasks:
- Checks the system's
npxbinary path and version usingcommand -vandnpx --version. - Employs a Python script (
python3 -c) to merge user-provided credentials into a JSON configuration file. - Creates directories and writes configuration files using
mkdir,cat, andchmod. - Provides command snippets for the user to modify their shell startup profiles (e.g.,
.zshrc,.bashrc, or fish config) to persistently load environment variables. - [EXTERNAL_DOWNLOADS]: The skill uses
curlto make network requests to a user-provided WordPress site root URL to verify the availability of specific REST API endpoints (/wp-json/accelerate/v1,/wp-json/mcp/mcp-adapter-default-server, and/wp-json/wp/v2/wpmcp). - [DATA_EXFILTRATION]: During the verification step, the skill sends the collected WordPress username and application password to the user-specified site URL using HTTP Basic Authentication via
curlto confirm the credentials work before saving them.
Audit Metadata