run-linters
Pass
Audited by Gen Agent Trust Hub on May 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
composer,npm, andnpxto run various linting and static analysis tools (SKILL.md). - [COMMAND_EXECUTION]: Specifically for Altis projects, the skill executes a local PHP script using the command
composer server cli -- eval-file .claude/lint-runner.php(SKILL.md). - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it reads and executes command strings defined in
package.jsonandcomposer.jsonscripts without prior validation (SKILL.md). - Ingestion points: Script definitions are read from the project's
package.jsonandcomposer.jsonfiles. - Boundary markers: Absent. The instructions do not define markers to separate trusted instructions from untrusted script content.
- Capability inventory: The skill employs the agent's shell execution capabilities to run discovered scripts.
- Sanitization: Absent. The skill assumes the scripts found in project metadata are legitimate and safe to execute.
Audit Metadata