phpcheck-url
Installation
SKILL.md
From this skill's directory, run:
node scripts/phpcheck.js "https://example.com" --json
Use HTTPS for a bare hostname. The checker reads Server and X-Powered-By
headers. If the version is hidden, report unknown.
Versions below an upstream fix return potentially_vulnerable with exit code 1.
PHP 5.4–5.6, 7.0–7.4, 8.0 and 8.1 also return this warning. A higher patch
number on those branches, such as 8.1.35, does not establish a fix.
Exit code 1 is a version-based warning, not proof that the installed package is unpatched. HTTP headers cannot tell whether the version contains a backported fix. Describe the result as potentially vulnerable, never confirmed vulnerable.