deploying-to-cloud
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external documentation and processes machine-readable command output, creating a surface for potential instruction injection.\n
- Ingestion points: Documentation fetched from https://cloud.laravel.com/docs/llms.txt via WebFetch, and JSON output from cloud CLI commands like list, get, and usage.\n
- Boundary markers: The instructions lack explicit delimiters or warnings to ignore embedded instructions within these external inputs.\n
- Capability inventory: The skill can execute arbitrary shell commands (cloud command:run) and PHP code (cloud tinker) on remote cloud environments, and perform CRUD operations on databases, buckets, and secrets.\n
- Sanitization: No sanitization or validation logic is specified for the external content before it is processed by the agent.\n- [COMMAND_EXECUTION]: The skill provides instructions for executing arbitrary shell commands on remote Laravel Cloud environments via the cloud command:run interface.\n- [DYNAMIC_EXECUTION]: The skill enables the execution of arbitrary PHP code on remote cloud environments using the cloud tinker command.\n- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of packages such as laravel/cloud-cli and league/flysystem-aws-s3-v3 from public registries, and fetches documentation from the vendor's official domain (cloud.laravel.com).
Audit Metadata