laravel-specialist
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-defined requirements to generate application architecture and code, which introduces an attack surface for indirect injection if the source data is malicious.\n
- Ingestion points: User-provided specifications during the requirement analysis phase in SKILL.md.\n
- Boundary markers: Absent. The skill lacks explicit delimiters to separate user-provided content from the agent's instructional logic.\n
- Capability inventory: The agent is instructed to run system commands via
php artisanfor migrations, routing, and testing across all reference files.\n - Sanitization: The skill explicitly mandates that the agent must not skip validation on user input and must avoid raw SQL queries to prevent injection attacks (SKILL.md).\n- [COMMAND_EXECUTION]: The skill utilizes standard Laravel Artisan commands for project management and verification.\n
- Evidence: Execution of
php artisan migrate:status,php artisan route:list,php artisan test, andphp artisan queue:workare integrated into the core workflow and validation checkpoints (SKILL.md).\n- [DYNAMIC_EXECUTION]: The skill involves the generation and subsequent testing of PHP scripts based on user requirements.\n - Evidence: Workflow steps include implementing models and building features followed by immediate execution of
php artisan testto verify the generated code (SKILL.md, references/testing.md).
Audit Metadata