php-ssrf-audit
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted PHP source code for security vulnerabilities.
- Ingestion points: The skill reads PHP project source code as its primary data source (SKILL.md).
- Boundary markers: The instructions do not define specific delimiters or "ignore" markers to separate the untrusted source code from the agent's internal instructions.
- Capability inventory: The skill has the capability to write output to the local file system at
{output_path}/vuln_audit/ssrf_{timestamp}.md(SKILL.md). - Sanitization: There is no mention of sanitizing or escaping the content of the analyzed source code before it is processed or written to reports, which could allow specially crafted code to influence the auditor's findings or report output.
Audit Metadata