code-quality-grumphp
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill configures well-known, industry-standard development tools (PHPStan, Pint, PHPCS, Pest) using their official or widely-accepted configurations.
- [COMMAND_EXECUTION]: Executable commands are limited to standard package managers (
composer) and local development tools (grumphp,php artisan). These are standard for the described workflow and do not involve unauthorized privilege escalation. - [EXTERNAL_DOWNLOADS]: All suggested dependencies are popular, well-maintained packages from the official PHP package registry (Packagist). No untrusted or remote scripts (e.g., curl | bash) are used.
- [PROMPT_INJECTION]: The skill includes explicit instructions for the AI agent to never bypass security/quality hooks (e.g., using --no-verify) and to always seek user approval before applying fixes, which mitigates risks of unauthorized code changes.
Audit Metadata