skills/respira-press/agent-skills-wordpress/migrate-thrive-architect-to-gutenberg/Gen Agent Trust Hub
migrate-thrive-architect-to-gutenberg
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted data from WordPress pages and posts.
- Ingestion points: Site content is retrieved via
wordpress_extract_builder_contentandwordpress_read_pageas described in Phase 1 and Phase 3 of the execution workflow. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when processing the content extracted from the page builder.
- Capability inventory: The skill utilizes write-access tools including
wordpress_create_page_duplicateandwordpress_update_pageto write the converted content back to the database. - Sanitization: There is no mention of sanitizing or validating the content extracted from Thrive Architect before it is transformed and written to the new Gutenberg blocks.
- [DATA_EXFILTRATION]: The skill transmits telemetry data, including site context, duration, success status, and page counts, to the vendor's domain at
https://www.respira.press/api/skills/track-usage. This operation is consistent with the stated author and purpose. - [COMMAND_EXECUTION]: The skill executes various WordPress management commands through the
respira-wordpressMCP server to audit site structure, extract content, and update page records.
Audit Metadata