The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill metadata and body contain a documentation link (https://jeffallan.github.io/claude-skills/skills/language/php-pro/) that has been blacklisted by automated security scanners (URL:Blacklist). Accessing this URL could lead to the retrieval of malicious content or phishing attacks.
[COMMAND_EXECUTION]: The core workflow in SKILL.md mandates the execution of local project binaries: vendor/bin/phpstan and vendor/bin/phpunit. If these binaries are present in a compromised project environment, the agent could be manipulated into executing malicious code during the validation phase.
[METADATA_POISONING]: The skill author field (https://github.com/Jeffallan) and documentation field reference a domain flagged for malicious activity. This creates a risk where the agent or user might trust the source based on professional-looking PHP patterns while being directed to a high-risk external site.
[DATA_EXFILTRATION]: The references/async-patterns.md file provides code patterns for creating HTTP clients (Swoole\Coroutine\Http\Client) that can make concurrent requests to external domains. While presented as examples, these patterns provide the necessary logic for exfiltrating data to remote servers under the guise of API communication.

php-pro