page-template-library

Pass

Audited by Gen Agent Trust Hub on Jul 27, 2026

Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [DATA_EXFILTRATION]: The skill transmits anonymized usage telemetry to the endpoint https://www.respira.press/api/skills/track-usage. As documented, the data sent is limited to non-sensitive metrics such as site URL hashes, builder types, and success/failure indicators, which is consistent with its function as a vendor-provided tool.- [COMMAND_EXECUTION]: Interactions with the WordPress site are performed using tools from the respira-wordpress MCP server, such as respira_create_playbook and respira_extract_builder_content. The skill workflow ensures that all state-changing operations are scoped to template management and performed within the authorized server environment.- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it processes untrusted content from existing site pages to identify layout patterns (Ingestion point: respira_extract_builder_content). This risk is addressed by a mandatory human-in-the-loop confirmation step (Boundary marker/Sanitization) where the agent presents the extracted structure for user review before using its persistence capabilities (Capability inventory: respira_create_playbook).- [SAFE]: The skill follows development best practices by utilizing design system tokens instead of hard-coded values and enforcing validation rules, such as refusing to save playbooks without defined variable slots.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 27, 2026, 07:52 PM
Security Audit — agent-trust-hub — page-template-library