drupal-config-mgmt

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses multiple command-line interfaces to interact with local and remote Drupal environments.
  • Evidence: Executes drush, git, ddev, terminus (Pantheon), acli (Acquia), platform (Platform.sh), upsun, and lagoon (amazee.io) commands across all files.
  • [DYNAMIC_EXECUTION]: The skill utilizes the drush php:eval command to perform programmatic updates to the Drupal database configuration, which involves executing PHP code snippets provided in the instructions.
  • Evidence: Found in SKILL.md and references/examples.md for updating config_split settings directly in the active configuration.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external Drupal configuration files (YAML), which creates a potential surface for instructions embedded in data to influence the agent's behavior during sync or merge operations.
  • Ingestion points: Reads configuration YAML files from the local filesystem (config/default/*.yml) and retrieves remote configuration via hosting CLIs as documented in SKILL.md and references/examples.md.
  • Boundary markers: The instructions do not specify delimiters or boundary markers to isolate the configuration data from the execution context.
  • Capability inventory: The skill has the capability to execute shell commands, perform file system writes, and interact with remote hosting platforms.
  • Sanitization: No specific sanitization or validation of the YAML content is mentioned before it is processed by the agent or passed to CLI tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 11:56 AM