laravel-plugin-discovery
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill file (SKILL.md) consists entirely of Markdown-based instructions and configuration examples. It does not include any scripts, executables, or code blocks that would be automatically executed by the agent or on the host system.
- [EXTERNAL_DOWNLOADS]: The skill provides a URL for an MCP server (
https://laraplugins.io/mcp/plugins) to be added to the user's configuration. This is a standard Model Context Protocol implementation for external tool integration and does not involve downloading or executing untrusted shell scripts or binaries. - [PROMPT_INJECTION]: The skill facilitates the ingestion of data from an external source (LaraPlugins.io API) via the MCP server. Analysis of this Category 8 surface shows: 1. Ingestion points: Output from SearchPluginTool and GetPluginDetailsTool; 2. Boundary markers: Absent; 3. Capability inventory: No high-risk capabilities like file system writes or subprocess execution are present in the skill; 4. Sanitization: Absent. While this creates a theoretical surface for indirect prompt injection if the external source were compromised, the skill's own instructions contain no malicious overrides, safety bypasses, or system prompt extraction attempts.
Audit Metadata