The Agent Skills Directory

[SAFE]: No security concerns were identified. The skill correctly follows least-privilege principles by only reading necessary configuration files (composer.json, phpstan.neon) to provide context for the agent. No network operations, obfuscation, or unauthorized command executions were found.
[SAFE]: The inspection script scripts/phpstan_inspect.mjs performs local file system reads of standard project configuration files and returns a structured JSON report to the agent. It does not attempt to access sensitive files outside the project directory (e.g., SSH keys, AWS credentials) or exfiltrate data to remote servers.
[SAFE]: The documentation and suggested commands (composer require, vendor/bin/phpstan) are standard for professional PHP development environments and do not involve suspicious installation patterns or remote code execution from untrusted sources.

wp-phpstan