drupal-config-mgmt
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses multiple command-line interfaces to interact with local and remote Drupal environments.
- Evidence: Executes
drush,git,ddev,terminus(Pantheon),acli(Acquia),platform(Platform.sh),upsun, andlagoon(amazee.io) commands across all files. - [DYNAMIC_EXECUTION]: The skill utilizes the
drush php:evalcommand to perform programmatic updates to the Drupal database configuration, which involves executing PHP code snippets provided in the instructions. - Evidence: Found in
SKILL.mdandreferences/examples.mdfor updatingconfig_splitsettings directly in the active configuration. - [INDIRECT_PROMPT_INJECTION]: The skill processes external Drupal configuration files (YAML), which creates a potential surface for instructions embedded in data to influence the agent's behavior during sync or merge operations.
- Ingestion points: Reads configuration YAML files from the local filesystem (
config/default/*.yml) and retrieves remote configuration via hosting CLIs as documented inSKILL.mdandreferences/examples.md. - Boundary markers: The instructions do not specify delimiters or boundary markers to isolate the configuration data from the execution context.
- Capability inventory: The skill has the capability to execute shell commands, perform file system writes, and interact with remote hosting platforms.
- Sanitization: No specific sanitization or validation of the YAML content is mentioned before it is processed by the agent or passed to CLI tools.
Audit Metadata