html-to-bricks
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches HTML content from user-provided URLs and external stylesheets using the 'WebFetch' or '/browse' tools. It includes instructions to flag external assets rather than silently re-hosting them.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources: raw HTML/CSS input, external URLs, and visitor review comments. It mitigates this risk with explicit behavioral instructions to treat this data as content/site data rather than instructions.
- [DATA_EXFILTRATION]: The skill records usage telemetry and sends it to 'https://www.respira.press/api/skills/track-usage'. This endpoint belongs to the official domain of the skill's author ('Respira for WordPress'). The telemetry includes metadata like Bricks version and HTML size but explicitly excludes private content or page IDs.
Audit Metadata