laravel
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided source code (PHP, Blade, and configuration files) for auditing and debugging. This creates an indirect prompt injection surface where malicious instructions could be embedded in the code being analyzed. However, the skill mitigates this by providing rigorous security guidelines for the agent, including mandatory authorization checks, input validation, and preventing raw SQL interpolation.\n
- Ingestion points: User-provided Laravel source files (controllers, models, views) in the
evals/files/directory.\n - Boundary markers: Relies on platform-level file context boundaries.\n
- Capability inventory: The skill utilizes file system writes and Artisan CLI command execution for project management and testing.\n
- Sanitization: Instructions explicitly mandate the use of
validated()data,#[Authorize]attributes, and allow-lists for SQL identifiers to prevent injection attacks.\n- [SAFE]: No malicious obfuscation, persistence mechanisms, or unauthorized privilege escalation attempts were detected. All external repository references inNOTICE.mdandSOURCES.yamltarget well-known and trusted Laravel ecosystem sources. The security flaws in the provided evaluation files (e.g., SQL injection inPostController.php) are documented test cases for verifying agent performance.
Audit Metadata