wp-phpstan
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows standard development practices for PHPStan integration in WordPress environments. All recommended packages (e.g., szepeviktor/phpstan-wordpress, php-stubs/wordpress-stubs) are well-known and trusted community resources for static analysis.
- [COMMAND_EXECUTION]: The skill uses a script
scripts/phpstan_inspect.mjsto gather information about the repository's configuration. This script only performs read-only operations on standard configuration files (composer.json, phpstan.neon) and does not execute external commands or perform network requests. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a standard attack surface by reading repository files (composer.json, phpstan.neon).
- Ingestion points: Reads
composer.jsonand PHPStan configuration files inscripts/phpstan_inspect.mjs. - Boundary markers: The script produces a structured JSON report for the agent, minimizing the risk of instructions in the files being interpreted as agent commands.
- Capability inventory: The skill instructs the agent to run PHPStan commands based on the discovered configuration (e.g.,
composer run phpstan). - Sanitization: The script uses standard JSON parsing and file reading. It does not evaluate the content of the files as code.
Audit Metadata