drupal-search-api
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides several
ddev drushcommands for managing Drupal configuration (e.g.,config:set,config:get) and controlling the Search API index (e.g.,search-api:clear,search-api:index). These are legitimate administrative tools for the intended environment. - [DYNAMIC_EXECUTION]: The skill uses
ddev drush php:evalto execute static PHP snippets that modify Drupal configuration objects directly. This method is used to handle complex configuration changes, such as unsetting array keys or maintaining specific field types during export, which is standard for advanced Drupal configuration management. - [INDIRECT_PROMPT_INJECTION]: The skill implements logic that processes Drupal entity field values (such as
field_featuredor bookmark counts) to calculate and apply search boosts. - Ingestion points: Entity field values are accessed via
$item->getOriginalObject()->getValue()within theFeaturedContentBoostclass in bothSKILL.mdandREADME.md. - Boundary markers: None; the skill operates on trusted internal entity data within the CMS environment.
- Capability inventory: The skill can modify search index relevance via
setBoost()and adjust system configuration viadrushcommands. - Sanitization: The skill relies on Drupal's core entity API and configuration management system to handle data safely.
Audit Metadata