wp-gravity-smtp

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: Utilizes wp-cli commands like wp gf install and wp gf update for plugin management and system inspection. These actions are within the expected scope for WordPress administration.
  • [DYNAMIC_EXECUTION]: Uses php -r to evaluate plugin versions and wp eval to send test emails. The executed code is static and used for utility purposes.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests environment data such as plugin versions and database option keys.
  • Ingestion points: Output from wp-cli commands in SKILL.md.
  • Boundary markers: Not used for interpolating environment data.
  • Capability inventory: Shell execution and PHP evaluation capabilities available in the skill environment.
  • Sanitization: No explicit sanitization of environment data before use in logic.
  • [EXTERNAL_DOWNLOADS]: Fetches and installs the Gravity SMTP plugin via the command line, which is a standard procedure for WordPress extensibility.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 07:32 AM