wp-gravity-smtp
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Utilizes
wp-clicommands likewp gf installandwp gf updatefor plugin management and system inspection. These actions are within the expected scope for WordPress administration. - [DYNAMIC_EXECUTION]: Uses
php -rto evaluate plugin versions andwp evalto send test emails. The executed code is static and used for utility purposes. - [INDIRECT_PROMPT_INJECTION]: The skill ingests environment data such as plugin versions and database option keys.
- Ingestion points: Output from
wp-clicommands inSKILL.md. - Boundary markers: Not used for interpolating environment data.
- Capability inventory: Shell execution and PHP evaluation capabilities available in the skill environment.
- Sanitization: No explicit sanitization of environment data before use in logic.
- [EXTERNAL_DOWNLOADS]: Fetches and installs the Gravity SMTP plugin via the command line, which is a standard procedure for WordPress extensibility.
Audit Metadata