drupal-search-api

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides several ddev drush commands for managing Drupal configuration (e.g., config:set, config:get) and controlling the Search API index (e.g., search-api:clear, search-api:index). These are legitimate administrative tools for the intended environment.
  • [DYNAMIC_EXECUTION]: The skill uses ddev drush php:eval to execute static PHP snippets that modify Drupal configuration objects directly. This method is used to handle complex configuration changes, such as unsetting array keys or maintaining specific field types during export, which is standard for advanced Drupal configuration management.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements logic that processes Drupal entity field values (such as field_featured or bookmark counts) to calculate and apply search boosts.
  • Ingestion points: Entity field values are accessed via $item->getOriginalObject()->getValue() within the FeaturedContentBoost class in both SKILL.md and README.md.
  • Boundary markers: None; the skill operates on trusted internal entity data within the CMS environment.
  • Capability inventory: The skill can modify search index relevance via setBoost() and adjust system configuration via drush commands.
  • Sanitization: The skill relies on Drupal's core entity API and configuration management system to handle data safely.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 09:26 PM