php-session-cookie-audit
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it is designed to ingest and analyze untrusted external data (PHP source code and tracer logs).
- Ingestion points: The agent reads PHP project source code and trace output from
php-route-tracer(SKILL.md). - Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the analyzed source code as untrusted data or to ignore embedded instructions within that code.
- Capability inventory: The skill performs file system write operations to
{output_path}/vuln_audit/sess_{timestamp}.md(SKILL.md). - Sanitization: There is no evidence of sanitization, escaping, or validation of the content extracted from the source code before it is interpolated into the final audit report.
Audit Metadata