php-upgrade
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing and using established PHP development tools including Rector, PHPCompatibility, php-parallel-lint, and PHPUnit via Composer. These are standard open-source tools for the PHP ecosystem.
- [EXTERNAL_DOWNLOADS]: The skill references and directs the agent to fetch migration guides from the official php.net manual, which is a trusted and well-known service for PHP development.
- [INDIRECT_PROMPT_INJECTION]: The skill involves processing external documentation and project source code. While this presents a theoretical attack surface for indirect prompt injection (e.g., malicious instructions hidden in a library's migration notes), it is the primary and intended purpose of the skill. The risk is mitigated by the use of structured tools and reliance on official documentation sources.
- Ingestion points: External migration guides from php.net; local project source code and configuration files.
- Boundary markers: None explicitly defined in the prompts, though instructions specify looking for specific migration items.
- Capability inventory: File system read/write, subprocess execution (Rector, Composer, PHPUnit, Lint), and network access (Composer update, documentation fetching).
- Sanitization: Standard tool-based processing of code; documentation analysis is handled by the agent's reasoning.
Audit Metadata