octane-development

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill consists of purely instructional markdown content aimed at helping developers avoid common pitfalls in long-running PHP environments. It does not contain any executable scripts, shell commands, or obfuscated code.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to use a search-docs tool to fetch external information from documentation websites. This introduces a technical surface for indirect prompt injection if the source content were to be compromised.
  • Ingestion points: Data retrieved by the search-docs tool from external domains mentioned in the References section (SKILL.md).
  • Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the fetched documentation.
  • Capability inventory: The skill itself has no capabilities (no scripts or subprocess calls); however, the agent's general toolset is the relevant capability set.
  • Sanitization: No sanitization or validation of the retrieved documentation content is specified.
  • Note: The identified target sources (laravel.com, frankenphp.dev, openswoole.com, and roadrunner.dev) are official and well-known technology service providers. Using them as a source of truth for technical documentation is a standard and safe developer practice.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 09:16 PM