typo3-extension-upgrade
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the execution of multiple command-line tools to perform its upgrade tasks. This includes
composerfor dependency management,rectorandfractorfor code transformations,phpstanandphp-cs-fixerfor quality and analysis, andphpunitfor testing. TheSKILL.mdalso provides specific shell script blocks for auditing class removals and verifying installation states. - [EXTERNAL_DOWNLOADS]: The workflow involves fetching external resources and data. Specifically, it uses
composerto download TYPO3 core and extension dependencies. Additionally, thereferences/api-traps.mdfile suggests using theghCLI to interact with the official TYPO3 core repository on GitHub to verify API existence across different versions. - [INDIRECT_PROMPT_INJECTION]: The skill processes and modifies a variety of project files, including PHP classes, TypoScript configurations, and Fluid templates. This creates a surface for indirect prompt injection if the source code being upgraded contains adversarial instructions; however, the skill's own logic is focused on legitimate architectural migrations and follows standard development patterns.
Audit Metadata