phpstan-fixer

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes standard shell commands for project reconnaissance and verification, including grep, cat, and vendor/bin/phpstan. These are local operations necessary for the skill's primary function of static analysis and error resolution.
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing well-known community packages from official registries, such as larastan/larastan, phpstan/phpstan-symfony, and barryvdh/laravel-ide-helper. These are established tools within the PHP ecosystem used to improve analysis accuracy.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data including project source files and PHPStan error logs which could theoretically contain malicious instructions.
  • Ingestion points: Reads composer.json, phpstan.neon, AGENTS.md, and various PHP source files in the project.
  • Boundary markers: None explicitly specified for separating code content from instructions during ingestion.
  • Capability inventory: Has the ability to read/write files and execute shell commands (composer, php artisan, phpstan).
  • Sanitization: Relies on the user's manual review of proposed changes and uses a human-in-the-loop Question tool before performing significant actions like ignoring errors.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 02:18 PM