php-pro
Fail
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation link https://jeffallan.github.io/claude-skills/skills/language/php-pro/ provided in SKILL.md is flagged as malicious by automated reputation scanners (URL:Blacklist). This indicates the source may host harmful content.
- [CREDENTIALS_UNSAFE]: Reference files, specifically references/async-patterns.md, include code snippets with hardcoded database credentials such as 'user' => 'root' and 'password' => 'password'.
- [COMMAND_EXECUTION]: The skill provides templates in references/async-patterns.md for establishing network servers on 0.0.0.0 and executing raw database queries, which represent dangerous capabilities if misused.
- [INDIRECT_PROMPT_INJECTION]: The skill has a high surface area for indirect injection. 1. Ingestion points: Processes user architectural requirements and framework context. 2. Boundary markers: Lacks explicit delimiters for user-provided architecture notes. 3. Capability inventory: Capable of generating complex service logic and network client code. 4. Sanitization: No evidence of input validation before interpolating user requirements into code templates.
Recommendations
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata