respira-setup-assistant
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for users to manually download the Respira for WordPress plugin from the official vendor website (respira.press). It also suggests using
npxto set up or update the Respira MCP server. Both resources originate from the verified vendor's infrastructure. - [COMMAND_EXECUTION]: The skill instructs the user to execute configuration and update commands (e.g.,
npx -y @respira/wordpress-mcp-server --setup) in their local terminal. These are not executed automatically by the agent and are restricted to the vendor's official package. - [DATA_EXFILTRATION]: The skill includes instructions to send fire-and-forget telemetry data regarding skill usage and connection status to the vendor's official endpoint (https://www.respira.press/api/skills/track-usage). The data collected is technical in nature (versions, duration, and success/failure) and is sent to a trusted vendor domain.
- [CREDENTIALS_UNSAFE]: The skill provides guidance on managing API keys and basic authentication credentials for staging sites. It correctly instructs users to store these in the MCP server configuration (environment variables) rather than hardcoding them within the skill itself, following security best practices.
Audit Metadata