phpstan-fix
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
vendor/bin/phpstan, which is a local binary typical for PHP projects. While this is intended behavior, it involves executing a filesystem-resident tool.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by analyzing files within thesrc/directory and acting on the output of PHPStan. - Ingestion points: Local source files in the
src/directory and the resulting tool output. - Boundary markers: None provided to distinguish between code and instructions within the processed files.
- Capability inventory: Includes shell command execution (
phpstan), file reading, and file writing (for applying fixes). - Sanitization: No sanitization or validation of the source code content is performed before processing.
Audit Metadata