The Agent Skills Directory

[SAFE]: The skill emphasizes essential PHP security controls. It specifically mandates the use of PDO prepared statements to prevent SQL injection, password_hash()/password_verify() for secure authentication, and htmlspecialchars() for XSS prevention. It also warns against unsafe unserialize() usage by recommending the allowed_classes => false option.
[COMMAND_EXECUTION]: The skill includes scripts/verify.sh, which is a utility script intended for developers to run locally. The script is designed for safety: it uses set -euo pipefail, handles file paths securely with find -print0, and performs read-only checks (linting, dry-run formatting, static analysis) without requesting elevated privileges or performing network operations.
[INDIRECT_PROMPT_INJECTION]: The skill involves processing PHP source code and composer.json files, which represents an ingestion surface for potentially untrusted data (e.g., code from external contributors or third-party libraries).
Ingestion points: PHP files and composer.json within the project workspace (SKILL.md).
Boundary markers: None explicitly defined for the agent's internal reasoning, though the skill provides instructions on how the agent should write secure code.
Capability inventory: The agent is directed to write code, generate configuration files, and may use project tools like phpstan or pest if the execution environment permits.
Sanitization: The skill prescribes sanitization techniques (escaping, parameterization) for the output code it generates, effectively mitigating risks for the resulting application.

php