bagisto-package-development
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions involve the installation of a development dependency,
bagisto/bagisto-package-generator, which is a resource provided by the vendor to assist in scaffolding package components. - [INDIRECT_PROMPT_INJECTION]: The skill generates controllers and data handling logic that ingest external data from HTTP requests. This establishes a surface for indirect prompt injection where maliciously formatted input could potentially influence subsequent agent actions if that data is processed by the AI in a future step.
- Ingestion points: The
ReturnRequestControllerdescribed inui.mdprocesses data from user-submitted forms. - Boundary markers: The generated templates rely on standard application validation but do not include specific delimiters to prevent the AI from misinterpreting data as instructions.
- Capability inventory: The skill facilitates file creation, command execution via Artisan, and database modifications.
- Sanitization: The instructions correctly implement Laravel validation to ensure input data conforms to expected types and constraints.
Audit Metadata