migrate-divi-to-bricks
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill performs telemetry via a POST request to
https://www.respira.press/api/skills/track-usage. This domain is the official site of the developer ('respira-press'). The data collected involves usage metrics (duration, success status, and element counts) and site context, which is a standard practice for maintaining vendor-provided skills. - [PROMPT_INJECTION]: As the skill processes user-controlled WordPress content, it possesses an indirect prompt injection attack surface. This risk is mitigated by the skill's design:
- Ingestion points: Data is ingested from the WordPress
post_contentfield via thewordpress_extract_builder_contenttool as defined inSKILL.md. - Boundary markers: The agent is instructed to generate a migration plan and wait for explicit user approval before proceeding to the injection phase.
- Capability inventory: The skill uses managed WordPress tools for all database operations; it contains no shell execution, code evaluation, or unauthorized file access.
- Sanitization: The migration process includes decoding of common content encodings (HTML entities and percent-encoding) and requires the creation of draft duplicates rather than modifying original records.
Audit Metadata