deserialization-php
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download the
phpggctool from its official GitHub repository. This is a standard and expected action for the described penetration testing use case. - [COMMAND_EXECUTION]: The instructions utilize common CLI tools such as
php,curl, andpython3to generate payloads and interact with targets. These actions are within the scope of the skill's stated purpose for security testing. - [PROMPT_INJECTION]: The skill processes data from a state MCP server via
get_state_summary(), which creates a surface for indirect prompt injection from potentially untrusted engagement logs. - Ingestion points: MCP server engagement state (SKILL.md)
- Boundary markers: Absent
- Capability inventory: Shell command execution and network requests via
php,python3, andcurl(SKILL.md) - Sanitization: None identified for processing external state data.
Audit Metadata