wp-gravity-connect
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: Recommends storing API keys in system environment variables via PHP's
getenv()function instead of the WordPress database, which is a secure alternative to local storage. It also references official documentation and service endpoints for OpenAI and OpenRouter. - [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: Provides instructions for installing the 'Spellbook' plugin platform via WP-CLI and the vendor's dashboard. These are standard administrative procedures for the Gravity Wiz plugin ecosystem.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates workflows where user-provided form data is dynamically inserted into AI prompts using Gravity Forms merge tags. This creates a known attack surface for indirect prompt injection.
- Ingestion points: Gravity Forms field data in SKILL.md prompt configuration examples.
- Boundary markers: None identified in the provided setup templates.
- Capability inventory: Processes entry data through external AI model APIs (OpenAI, OpenRouter) for text and image generation.
- Sanitization: No specific input validation or escaping steps are detailed in the configuration procedure.
Audit Metadata