migrate-oxygen-to-breakdance
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary function is structural data mapping between WordPress page builders. It uses a safety-oriented workflow that performs a read-only audit and requires explicit user confirmation before creating non-published page duplicates.
- [DATA_EXFILTRATION]: The skill transmits usage telemetry (including success rates, page counts, and tool performance) to the author's official domain at
https://www.respira.press/api/skills/track-usage. As this targets the vendor's own infrastructure and involves only metadata, it is considered a legitimate functional requirement. - [COMMAND_EXECUTION]: All site operations are conducted through specialized WordPress MCP tools (e.g.,
wordpress_extract_builder_content,wordpress_inject_builder_content). These tools provide structured access to WordPress APIs rather than raw shell access. - [PROMPT_INJECTION]: The skill reads external page content which theoretically presents an indirect prompt injection surface. However, the logic is constrained to structural JSON mapping (Oxygen to Breakdance elements), significantly mitigating the risk of instructions embedded in page content influencing agent behavior.
Audit Metadata