SiteAgent Elementor Studio

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 12:53 AM UTC
• Version: 1.3.2

Overview

This skill is a disclosed WordPress/Elementor site-building helper, but users should treat its setup as high-trust because it installs plugins and stores a reusable WordPress credential locally.

Install only for WordPress sites you are authorized to manage. Use a dedicated low-privilege WordPress Application Password, keep .mcp.json private, consider pinning EMCP_PIN_VERSION, revoke or rotate the password after setup or handoff, and confirm form recipients/privacy terms before enabling live contact forms.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions include broad natural-language phrases like asking to build, edit, inspect, or troubleshoot an Elementor page. Broad triggers can cause unintended invocation of a high-privilege skill that has shell, network, filesystem, and credential-handling behaviors, increasing the chance the agent enters this workflow without deliberate user intent. In this context, accidental invocation is more dangerous because the skill can write `.mcp.json`, handle WordPress credentials, and guide destructive site changes once activated.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guidance instructs the agent to create a live submitting form with email delivery but does not require any warning or confirmation that user-entered data will be transmitted to site administrators. In a content-building skill, that omission can cause an agent to deploy a production-like data collection endpoint without the user's explicit awareness of privacy, consent, retention, or misdelivery implications.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The fallback workflow directs setup of Fluent Forms and email notifications, including confirmation of the recipient address, but omits a privacy and operational warning that the form will collect and transmit real user submissions. This is risky because the skill is operational and can lead to immediate deployment of a working intake channel, increasing chances of unintended data collection, spam routing, or sending submissions to the wrong mailbox.

External Transmission

Medium

• Category: Data Exfiltration

Content

2. `create-page({title, status: "publish", template: "elementor_canvas"})` — Canvas template removes theme header/footer chrome so your design is the only thing on the page
3. (Via WP-CLI) Set as static front page: `wp option update show_on_front page; wp option update page_on_front <id>`
4. Build sections — **use the matching recipe from the Recipe library** (outer container → inner boxed container, max-width ~1360px → content), bound to brand tokens
5. After each section: `get-page-structure(post_id)` to verify nesting, or just curl the front page
6. **Pause for human review** before building header/footer (which use Header Footer Elementor templates, a different flow)

## When the user asks to EDIT

• Confidence: 78% confidence
• Finding: The skill instructs the agent to 'curl the front page' for verification, which causes external network transmission to the target WordPress site and may include authenticated or environment-specific content. While expected in a site-management skill, this still expands data exposure and can leak private page state, staging content, or sensitive headers to logs or external infrastructure if performed without explicit need and clear user awareness.

Session Persistence

Medium

• Category: Rogue Agent

Content

#!/usr/bin/env bash
# =============================================================================
# setup-elementor-mcp.sh — Wire up the Elementor MCP server against a
# WordPress site (Local-by-Flywheel or live host) and write a .mcp.json
# in the current directory so Claude Code can drive Elementor.
#
# Usage:  bash ~/.claude/scripts/setup-elementor-mcp.sh

• Confidence: 98% confidence
• Finding: The script intentionally writes a persistent .mcp.json containing a reusable Basic Authorization credential derived from the WordPress username and application password. Even though it warns the user and adds .gitignore protections, the credential remains stored in plaintext-equivalent form on disk and can be stolen from the filesystem, backups, shell working directories, or other local compromise paths.

External Script Fetching

High

• Category: Supply Chain

Content

EM_RELEASE_API="https://api.github.com/repos/Digitizers/elementor-mcp/releases/latest"
    info "Downloading the elementor-mcp fork (bundles the MCP Adapter, latest release from the trusted Digitizers repo over HTTPS; set EMCP_PIN_VERSION to pin a tag)..."
  fi
  EM_ZIPBALL=$(curl -s "$EM_RELEASE_API" \
    | python3 -c "$JQ_LENIENT_PY"'
import sys
d = _load(sys.stdin.read())

• Confidence: 95% confidence
• Finding: The script downloads release metadata and then a plugin zip from GitHub, defaulting to the latest release unless pinned. This creates a real supply-chain risk: a compromised repository, release asset, maintainer account, or network trust boundary could cause installation of malicious code directly into WordPress, and the script does not verify checksums, signatures, or an allowlisted digest before packaging and activating the plugin.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.