typo3-core-contributions
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes several automation scripts such as
setup-typo3-coredev.shandvalidate-commit-message.pythat execute shell commands to manage Git, DDEV, and Docker configurations. These are legitimate operations required to establish a local development environment for TYPO3. - [EXTERNAL_DOWNLOADS]: The
references/commit-msg-hook.mdandreferences/troubleshooting.mdfiles provide instructions to download an official Git hook from TYPO3's Gerrit review server (review.typo3.org). This operation is a standard part of the TYPO3 contribution workflow and originates from a well-known, trusted service. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of data from Forge issues and Gerrit reviews. These external, community-driven platforms represent a potential surface for indirect prompt injection from user-contributed text, though the risk is managed by the skill's focus on structured API interactions and version control.
- [SAFE]: The skill correctly manages credentials by advising users to store API keys in environment variables and provides secure guidance for SSH key management. No hardcoded secrets or suspicious obfuscation techniques were found.
Audit Metadata