executing-plans
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard development commands including Git operations (e.g.,
git checkout -b,git commit), Symfony console utilities (bin/console), and PHP testing/analysis tools (pest,phpstan,php-cs-fixer). These are all contextually appropriate and necessary for the stated implementation workflow.\n- [EXTERNAL_DOWNLOADS]: Includes instructions forcomposer install, which fetches PHP dependencies from the official Packagist registry. This is a well-known service and the standard method for managing libraries in the PHP ecosystem.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes implementation plans and code, creating an attack surface for indirect instructions. \n - Ingestion points: implementation plans and test files referenced in
SKILL.mdandreference.md.\n - Boundary markers: Absent; the skill relies on the structural progression of the TDD workflow to isolate tasks.\n
- Capability inventory: Requires
Bashfor command execution andWrite/Editfor file manipulation, as scoped in the frontmatter.\n - Sanitization: Absent; the skill assumes the plans being executed are provided by the user or a trusted source. As this is the primary purpose of a developer-oriented skill, the risk is considered low.
Audit Metadata