drupal-ddev

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides numerous shell commands for managing DDEV projects, including container lifecycle management (ddev start, ddev stop, ddev poweroff), database operations (ddev import-db), and Drupal-specific tooling via drush and composer.
  • [COMMAND_EXECUTION]: The documentation includes recovery procedures that use process termination commands, such as killall -9 com.docker.backend and pkill -f 'vendor/bin/drush', which are appropriately scoped to cleaning up orphaned processes and recovering from Docker engine crashes.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructions define an environment that ingests untrusted data from external sources, which is a common characteristic of local development tools.
  • Ingestion points: The agent may process database dumps (SQL files), project source code, and container logs as documented in references/database.md and references/workflows.md.
  • Boundary markers: There are no explicit instructions for the agent to use delimiters when processing this data, which is standard for technical documentation.
  • Capability inventory: The skill allows the agent to execute commands within containers, write configuration files, and manage local network services.
  • Sanitization: The skill explicitly recommends and provides patterns for database sanitization using drush sql-sanitize to ensure production data is cleaned before local use.
  • [EXTERNAL_DOWNLOADS]: The skill describes how to fetch official extensions and services for the development environment.
  • Fetches the official ddev-solr add-on from the well-known DDEV GitHub organization.
  • Pulls standard mariadb Docker images from Docker Hub for use in isolated testing environments.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 11:56 AM