wp-phpstan
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The
scripts/phpstan_inspect.mjsscript parses the repository'scomposer.jsonand PHPStan configuration to suggest the appropriate execution command. This introduces a surface where configuration files within the analyzed repository can influence the agent's suggested actions. - Ingestion points:
scripts/phpstan_inspect.mjs(readscomposer.json,phpstan.neon,phpstan.neon.dist). - Boundary markers: None explicitly used; the script output is a structured JSON report.
- Capability inventory: The skill provides instructions to execute terminal commands (e.g.,
composer run) based on the inspection report. - Sanitization: The script uses
JSON.parsefor structure and filters commands based on keywords, but does not sanitize the content of the script commands themselves. - [EXTERNAL_DOWNLOADS]: The skill recommends the use of reputable WordPress and plugin stub packages (such as
szepeviktor/phpstan-wordpressandphp-stubs/*) via Composer. These are standard, well-recognized resources for PHP static analysis and do not pose a security risk in this context.
Audit Metadata