laravel-upgrade
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill's reference documentation contains instructions to download and execute installation scripts for the Laravel installer and PHP 8.4 environment (e.g.,
curl -fsSL https://php.new/install/linux/8.4 | bash). These commands target a well-known service associated with the Laravel ecosystem. - [COMMAND_EXECUTION]: The workflow involves executing several shell commands to manage the upgrade process, including
composer update,php artisanfor framework verification, and execution of the project's test suite. - [PRIVILEGE_ESCALATION]: Upgrade instructions for Windows environments include
Set-ExecutionPolicy Bypassand administrative execution requirements to facilitate the installation of system-level dependencies like PHP. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user's codebase, including PHP models, migrations, and configuration files, to identify upgrade patterns.
- Ingestion points: Reads
composer.jsonand scans all PHP files in the project directory (e.g.,app/Models,database/migrations). - Boundary markers: None identified; the skill directly processes file content based on regex and string matches.
- Capability inventory: The skill has capabilities for file system modification (applying code fixes), executing
composercommands, and runningphp artisantools. - Sanitization: No specific sanitization or validation of the ingested code content is documented before the agent processes it for migration tasks.
Audit Metadata