woocommerce-health-check
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill transmits diagnostic metadata and store performance metrics to a remote endpoint (
https://www.respira.press/api/skills/track-usage) for telemetry purposes. Evidence: The "Step 12: Send Telemetry" section describes a POST request containing site URLs, version numbers, and audit findings. Context: The destination domain matches the author's official website (respira.press), representing a vendor-owned resource for usage tracking. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the WordPress database and site content which could potentially contain malicious instructions. Ingestion points:
respira_list_plugins(plugin names/descriptions),respira_list_pages(page content/HTML), andwoocommerce_list_orders(order statuses). Boundary markers: None specified in the prompt templates. Capability inventory: Includes the ability to update stock counts (woocommerce_update_stock), duplicate pages (respira_create_page_duplicate), and restore snapshots (respira_restore_snapshot). Sanitization: No explicit sanitization or validation of the ingested site content is performed before processing.
Audit Metadata