code-standards-checker
Warn
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill identifies shell command aliases by parsing project configuration files (composer.json, package.json) at runtime and then executes them. This dynamic assembly of commands from user-controlled files represents a potential execution vector.
- [INDIRECT_PROMPT_INJECTION]: The skill's workflow depends on ingesting data from external files which are then used to direct agent actions.
- Ingestion points: composer.json, package.json, and various theme/plugin package.json files.
- Boundary markers: None; the instructions prioritize reading from these files over internal knowledge ("Read, do not recall").
- Capability inventory: Execution of shell commands using composer, npm, npx, and ddev.
- Sanitization: None; the skill is designed to run the exact aliases found in the configuration files.
- [EXTERNAL_DOWNLOADS]: The skill initiates external package downloads, specifically recommending the installation of drupal/coder and wp-coding-standards/wpcs via composer. It also utilizes npx, which dynamically fetches packages from the public npm registry if not already present.
- [COMMAND_EXECUTION]: The skill relies on shell command execution for its core functionality, including the use of jq for file parsing and the execution of project-specific build and linting scripts.
Audit Metadata