The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions involve running project-specific development and quality assurance tools.
Evidence: Execution of vendor/bin/phpstan, vendor/bin/phpunit, and vendor/bin/pest within the local project environment as specified in SKILL.md.
[CREDENTIALS_UNSAFE]: Code snippets in the reference guides include generic credentials intended as placeholders for local development.
Evidence: references/async-patterns.md uses root and password for database connections to localhost and 127.0.0.1.
[INDIRECT_PROMPT_INJECTION]: The skill has a potential vulnerability surface for indirect prompt injection due to its core function of processing and acting upon external code and configuration data.
Ingestion points: External PHP source code and configuration files such as composer.json, .env, and phpstan.neon.
Boundary markers: Absent. There are no instructions defining how to distinguish code from potential instructions embedded within processed data.
Capability inventory: The skill performs file system writes (scaffolding code) and shell command execution (running analysis and test suites).
Sanitization: Absent. No specific validation or sanitization logic is provided for handling user-controlled files.

php-pro