laravel-livewire
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for building web components that ingest untrusted user data via property binding and action parameters.
- Ingestion points: User input is received through public properties bound with
wire:modeland parameters passed to component actions as described inSKILL.md. - Boundary markers: The skill instructions emphasize the use of the
#[Validate]attribute and the$this->validate()method to define constraints on user input. - Capability inventory: The code examples in
SKILL.mddemonstrate the ability to perform database writes (Post::create) and file system operations ($this->photo->store). - Sanitization: The documentation explicitly instructs the agent to validate all input and treat public properties as untrusted user data.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of the Livewire framework during the setup process.
- Fetches the
livewire/livewirepackage from the official PHP package registry (Packagist) viacomposer requirecommands documented inSKILL.md.
Audit Metadata