typo3-extension-upgrade

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the execution of multiple command-line tools to perform its upgrade tasks. This includes composer for dependency management, rector and fractor for code transformations, phpstan and php-cs-fixer for quality and analysis, and phpunit for testing. The SKILL.md also provides specific shell script blocks for auditing class removals and verifying installation states.
  • [EXTERNAL_DOWNLOADS]: The workflow involves fetching external resources and data. Specifically, it uses composer to download TYPO3 core and extension dependencies. Additionally, the references/api-traps.md file suggests using the gh CLI to interact with the official TYPO3 core repository on GitHub to verify API existence across different versions.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes and modifies a variety of project files, including PHP classes, TypoScript configurations, and Fluid templates. This creates a surface for indirect prompt injection if the source code being upgraded contains adversarial instructions; however, the skill's own logic is focused on legitimate architectural migrations and follows standard development patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 02:35 PM