The Agent Skills Directory

[SAFE]: The skill instructions and referenced documents provide standard, best-practice guidance for PHP development. The core rules emphasize strict typing (declare(strict_types=1)) and adherence to the PSR-12 coding standard, which are positive for code quality and maintainability.
[COMMAND_EXECUTION]: The skill includes shell commands for running quality tools like php-cs-fixer, phpstan, psalm, and rector, as well as phpunit for testing. These are standard developer tools and their usage within the skill is limited to local execution for code analysis and verification, with no evidence of command injection or malicious payload delivery.
[DATA_EXPOSURE]: No hardcoded credentials, sensitive file path access (outside of standard project structures like src or tests), or unauthorized data collection patterns were found. The tool documentation for Psalm mentions taint analysis, which is a defensive security practice for identifying data flow to dangerous sinks.
[REMOTE_CODE_EXECUTION]: There are no patterns of downloading and executing remote scripts (e.g., curl | bash). All package installations mentioned are standard and point to the project's own vendor directory.
[OBFUSCATION]: The files were scanned for Base64, zero-width characters, homoglyphs, and other encoding tricks. No obfuscated content or hidden URLs were detected.
[PRIVILEGE_ESCALATION]: There are no requests for elevated permissions, sudo usage, or modifications to system-level configurations.
[INDIRECT_PROMPT_INJECTION]: While the skill processes code, it does not include instructions that would cause an agent to deviate from its core purpose. The verification phase focuses on test pass rates and coverage metrics.

php