php-checks
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local developer tools including rector, pint, phpstan, and pest from the project's vendor directory. These commands are standard for PHP quality assurance.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface by processing external data and possessing capabilities to modify files and execute commands.
- Ingestion points: Reads composer.json, project PHP source files, and terminal output from linting and testing tools.
- Boundary markers: No specific delimiters are used to separate ingested project content from the agent's instructions.
- Capability inventory: The agent can modify PHP files and execute shell commands within the project environment.
- Sanitization: No explicit sanitization of the source code or tool output is performed.
Audit Metadata