replicate-with-blocks
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or behaviors were detected. The skill is structured with clear security boundaries, including a mandatory validation step that checks for XSS, PHP injection, and unescaped content in generated theme patterns.
- [EXTERNAL_DOWNLOADS]: The skill downloads self-hosted fonts and imagery from the source website during the replication process. These assets are stored locally within the theme's assets directory.
- [COMMAND_EXECUTION]: Utilizes Bash and the WordPress CLI to automate theme activation, site configuration (such as setting the static front page), and the removal of default WordPress content in the Studio environment.
- [PROMPT_INJECTION]: The skill processes untrusted HTML and WXR data from external sites, which presents a surface for indirect prompt injection. This risk is addressed through explicit validation routines (
liberate_validate_artifacts) that enforce strict escaping and provenance checks.
Audit Metadata