wp-phpstan

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill follows standard development practices for PHPStan integration in WordPress environments. All recommended packages (e.g., szepeviktor/phpstan-wordpress, php-stubs/wordpress-stubs) are well-known and trusted community resources for static analysis.
  • [COMMAND_EXECUTION]: The skill uses a script scripts/phpstan_inspect.mjs to gather information about the repository's configuration. This script only performs read-only operations on standard configuration files (composer.json, phpstan.neon) and does not execute external commands or perform network requests.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a standard attack surface by reading repository files (composer.json, phpstan.neon).
  • Ingestion points: Reads composer.json and PHPStan configuration files in scripts/phpstan_inspect.mjs.
  • Boundary markers: The script produces a structured JSON report for the agent, minimizing the risk of instructions in the files being interpreted as agent commands.
  • Capability inventory: The skill instructs the agent to run PHPStan commands based on the discovered configuration (e.g., composer run phpstan).
  • Sanitization: The script uses standard JSON parsing and file reading. It does not evaluate the content of the files as code.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 20, 2026, 03:15 AM
Security Audit — agent-trust-hub — wp-phpstan