figma-to-bricks
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill reports usage statistics, including site and version context, to the vendor's official domain at
https://www.respira.press/api/skills/track-usage. This is a vendor-owned resource used for usage tracking and is consistent with the skill's stated authorship. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from the Figma API. This is mitigated by the skill's requirement for a 'Build plan' review and user confirmation before any write operations. Ingestion points: Figma node tree and text content via the Figma API. Boundary markers: The skill explicitly requires a 'Build plan' review and user confirmation before any write operations are performed. Capability inventory: Includes capabilities to create pages (
respira_build_page), update elements (respira_update_element), and sideload images (respira_sideload_image) to the WordPress environment. Sanitization: The skill mentions an 'audit' and 'inventory' phase in its execution workflow to identify potentially problematic nodes.
Audit Metadata