php-file-write-audit
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external PHP source code, which represents untrusted data. There is an inherent risk that a malicious source file could contain strings intended to influence the agent's reasoning. However, the skill mitigates this by enforcing a strict, evidence-based reporting structure and mandatory checklists (e.g., EVID_WRITE_WRITE_CALLSITE), which grounds the output in verifiable static code patterns rather than arbitrary text.
- [SAFE]: The skill utilizes standard search tools like
rg(ripgrep) to perform static analysis of PHP projects. The instructions are focused on defensive security research, requiring thorough verification of vulnerabilities before reporting. It does not attempt to execute remote scripts, exfiltrate data, or bypass safety guidelines.
Audit Metadata