hyva-cms-components-dump
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes Magento CLI commands (e.g., bin/magento hyva:cms:list-disabled-components) to retrieve component data directly from the application environment.\n- [DYNAMIC_EXECUTION]: To support environments where CLI commands are unavailable, the skill executes a bundled PHP script (scripts/dump_cms_components.php) by streaming its content to the PHP interpreter over standard input.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external components.json files located in app/code and vendor directories. This data is merged and output as JSON, creating a potential surface for indirect injection if project files contain malicious content.\n
- Ingestion points: Reads app/etc/config.php for module status and etc/hyva_cms/components.json from all active modules.\n
- Boundary markers: No delimiters or explicit warnings are used when processing these files.\n
- Capability inventory: The skill has the ability to execute shell commands via the hyva-exec-shell-cmd dependency.\n
- Sanitization: No sanitization is performed on the ingested JSON content before it is merged and displayed.
Audit Metadata