code-review-php
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external PHP source code and project metadata, which creates an ingestion point for untrusted data. An attacker could embed malicious instructions within code comments or string literals to influence the reviewing agent.
- Ingestion points: PHP source files (.php), composer.json, and other webroot artifacts.
- Boundary markers: The skill does not define specific delimiters or warnings to isolate the analyzed content from agent instructions.
- Capability inventory: The skill utilizes static analysis tools such as ripgrep and semgrep; no capabilities for file modification or network communication are enabled.
- Sanitization: The instructions do not prescribe sanitization or filtering for the external code being processed.
Audit Metadata