symfony-upgrade
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads and processes local application files, which represents an indirect prompt injection surface.
- Ingestion points: The skill ingests data from composer.json, phpunit.xml.dist, rector.php, and PHP source files.
- Boundary markers: The skill does not use specific delimiters to isolate file content from the agent's instructions.
- Capability inventory: The skill uses the Bash tool to run composer, phpunit, and rector commands, which can execute logic defined in the project files.
- Sanitization: No sanitization is performed on project file content before tool execution.
- [COMMAND_EXECUTION]: The skill performs shell-based operations using the Bash tool.
- Evidence: The skill utilizes Bash to clear application caches via 'rm -rf var/cache/*' and to manage dependencies and testing through composer and phpunit CLI tools.
- [EXTERNAL_DOWNLOADS]: The skill fetches framework configuration updates and development tools from standard sources.
- Evidence: The skill uses 'composer recipes:update' to fetch official Symfony recipes and 'composer require' to install common development packages such as rector and phpunit-bridge.
Audit Metadata