typo3-rector
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the user to execute shell commands using
composerandddevto install dependencies and run the Rector refactoring tool. These are standard operations for PHP development and TYPO3 migrations. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process and migrate PHP source code and TCA (Table Configuration Array) files. While this creates a surface for processing untrusted code, it is the intended primary purpose of a migration tool.
- Ingestion points: PHP source files and TYPO3 TCA configuration files (e.g.,
Configuration/TCA/Overrides/*.php). - Boundary markers: None explicitly mentioned for the agent when processing user code.
- Capability inventory: Execution of
rector processandcomposervia shell commands. - Sanitization: No specific sanitization or escaping of external PHP content is mentioned; the skill relies on the underlying Rector tool's parsing logic.
- [EXTERNAL_DOWNLOADS]: The skill references the installation of
ssch/typo3-rectorfrom a well-known community repository, which is the standard tool for TYPO3 Rector migrations.
Audit Metadata