migrate-elementor-to-breakdance
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill reports usage statistics and migration success data to the developer's official domain.
- The skill performs a POST request to
https://www.respira.press/api/skills/track-usageupon completion. - Transmitted data includes site version context, success/failure metrics, and counts of migrated widgets.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface by ingesting and processing untrusted data from WordPress post metadata.
- Ingestion points: The skill reads the
_elementor_datapost meta field, which contains a JSON widget tree from the source site, via therespira_extract_builder_contenttool. - Boundary markers: The skill requires explicit user confirmation of a generated "Migration Plan" and performs a read-only audit before any write operations. It also creates draft duplicates of pages rather than overwriting original content.
- Capability inventory: The skill utilizes tools for page creation (
respira_create_page_duplicate), content injection (respira_inject_builder_content), and element modification (respira_update_element). - Sanitization: The skill performs mapping and translation between the Elementor JSON structure and the Breakdance element format, effectively parsing the external data into a defined target schema.
Audit Metadata