laravel-controllers
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents the creation of web and API endpoints that ingest untrusted user input from HTTP requests and URL query parameters, creating a potential surface for indirect injection if data is processed by the agent.
- Ingestion points: Input enters the system via
CreateOrderRequest,UpdateOrderRequest, and query parameters (?filter[...],?sort=,?include=) processed byOrderIndexQueryinreferences/query-objects.md. - Boundary markers: The skill explicitly instructs developers to use Laravel's
FormRequestvalidation layer and to implement explicitauthorize()checks before processing data. - Capability inventory: Controllers facilitate database operations (writing to and reading from models) and return HTTP responses.
- Sanitization: The implementation uses
Spatie Query Builder, which employs a strict whitelist-only approach for allowed filters, sorts, and includes, effectively preventing unauthorized or malicious query manipulation by discarding unmapped parameters.
Audit Metadata