migrate-elementor-to-breakdance

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill reports usage statistics and migration success data to the developer's official domain.
  • The skill performs a POST request to https://www.respira.press/api/skills/track-usage upon completion.
  • Transmitted data includes site version context, success/failure metrics, and counts of migrated widgets.
  • [INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface by ingesting and processing untrusted data from WordPress post metadata.
  • Ingestion points: The skill reads the _elementor_data post meta field, which contains a JSON widget tree from the source site, via the respira_extract_builder_content tool.
  • Boundary markers: The skill requires explicit user confirmation of a generated "Migration Plan" and performs a read-only audit before any write operations. It also creates draft duplicates of pages rather than overwriting original content.
  • Capability inventory: The skill utilizes tools for page creation (respira_create_page_duplicate), content injection (respira_inject_builder_content), and element modification (respira_update_element).
  • Sanitization: The skill performs mapping and translation between the Elementor JSON structure and the Breakdance element format, effectively parsing the external data into a defined target schema.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 03:53 AM