symfony-project-setup
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a deployment script (
deploy-prod.sh) and various development commands (DDEV, Composer, NPM). These perform legitimate administrative tasks such as building assets, running tests, and synchronizing code to a production server via SSH and rsync. - [INDIRECT_PROMPT_INJECTION]: The blueprint implements a contact form that accepts user-supplied data. To mitigate injection risks, the skill includes the
symfony/html-sanitizerbundle and applies strict validation constraints (e.g.,Assert\NotBlank,Assert\Length) and an Altcha CAPTCHA to the form fields. - [CREDENTIALS_UNSAFE]: The
.envfile uses placeholder credentials (e.g.,!ChangeMe!). The documentation correctly instructs users to store real secrets in a gitignored.env.localfile and ensures these sensitive files are excluded from the production deployment synchronization. - [DATA_EXFILTRATION]: The deployment script uses rsync to transfer the application to a remote server. This is the primary intended function of the script and follows security best practices by explicitly excluding development artifacts, local configuration, and secret files from the transfer.
Audit Metadata