respira-builder-edits

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted data by reading content from WordPress pages via tools like respira_read_page and respira_find_element. It possesses write capabilities through respira_update_element and respira_batch_update. The instructions include mandatory verification steps, builder-specific normalizers, and a validator for newer builder versions (e.g., Elementor 4) to maintain data integrity and mitigate risks from malformed inputs.
  • [SAFE]: The skill mentions a 'kses bypass' for specific builder modules (e.g., Divi 4 et_pb_code). This refers to the preservation of existing scripts or styles within specialized code modules during the update process, which is standard functional behavior for WordPress page builders rather than a security escalation.
  • [SAFE]: The skill includes diagnostic capabilities such as respira_diagnose_connection to detect network-level blocks from WAFs or services like Cloudflare, which is a legitimate robustness feature for remote management tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 04:53 PM