laravel-attributes
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill defines a mandatory workflow in SKILL.md that overrides the agent's default planning and execution logic. It requires the agent to spawn three specific sub-agents in parallel (fuse-ai-pilot:explore-codebase, fuse-ai-pilot:research-expert, and mcp__context7__query-docs) and perform a final validation step using a specific tool (fuse-ai-pilot:sniper).
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data from the user's codebase, creating a potential attack surface.
- Ingestion points: The skill utilizes the fuse-ai-pilot:explore-codebase tool to scan existing application models, jobs, and controllers.
- Boundary markers: There are no specific delimiters or instructions provided to the agent to treat content from the scanned codebase as untrusted or to ignore embedded instructions.
- Capability inventory: The workflow includes capabilities for scanning files, performing research, and validating implementation logic via vendor-provided tools.
- Sanitization: The skill does not specify any sanitization or validation protocols for the data ingested from the repository.
Audit Metadata