php-evgen
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No patterns detected that attempt to override system prompts or bypass safety guidelines. The instructions are focused purely on PHP development architecture.
- [DATA_EXFILTRATION]: No suspicious network operations or sensitive file access patterns were found. The skill correctly identifies that sensitive configuration should be stored in environment variables rather than hardcoded.
- [CREDENTIALS_UNSAFE]: The skill explicitly mandates security best practices for credentials, specifically instructing users not to store passwords in plain text and recommending the use of bcrypt or Argon2.
- [REMOTE_CODE_EXECUTION]: There are no patterns involving the download or execution of remote scripts. References to tools like Composer, PHPStan, and PHPUnit are standard for the PHP ecosystem.
- [COMMAND_EXECUTION]: No arbitrary shell command execution patterns were detected. All code examples are focused on static application logic and framework implementation.
- [OBFUSCATION]: The content is clear and readable without any Base64 encoding, zero-width characters, or hidden text patterns.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes user-provided application requirements, it includes constraints that promote defensive programming, such as input validation and strict typing, which mitigate injection risks in the generated code.
Audit Metadata