php-quality-tooling
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the installation of standard, well-known PHP development packages (PHPStan, Rector, and PHP-CS-Fixer) through the official Composer registry.
- [EXTERNAL_DOWNLOADS]: The GitHub Actions pipeline template utilizes trusted and well-known actions such as
shivammathur/setup-phpandactions/checkout. - [COMMAND_EXECUTION]: Provides standard command-line instructions for executing static analysis and code formatting tools via the local
vendor/bindirectory. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes codebase metadata (such as
composer.jsonand PHP source files) which are ingestion points for external data, though these are handled by industry-standard tools. - [DYNAMIC_EXECUTION]: Utilizes PHP-based configuration files (
rector.php,.php-cs-fixer.dist.php) which are executed by the respective tools to define rules and settings.
Audit Metadata