php-deser-audit
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external PHP source code, which is untrusted data. This creates a surface for instructions embedded within the analyzed code (such as in comments or strings) to potentially influence the agent's behavior or the contents of the generated report.
- Ingestion points: PHP project source code provided to the agent for analysis as described in the "PHP 反序列化审计" section.
- Boundary markers: Absent. The instructions do not define specific delimiters or guardrails to prevent the AI from following instructions found within the analyzed source code.
- Capability inventory: The skill performs file writing operations to
{output_path}/vuln_audit/to store audit reports and Proof-of-Concept (PoC) code. - Sanitization: Absent. There is no mention of sanitizing or escaping the content extracted from the source code before it is processed or written to the output files.
Audit Metadata