laravel-boost

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for standard development environment setup, including package installation using composer require and framework-specific configuration via php artisan boost:install.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the download of a development-dependency package from a well-known framework ecosystem. These downloads are standard for the described functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill identifies a surface area for indirect prompt injection by consuming project-specific guidelines and domain-specific skills during the agent's execution phase.
  • Ingestion points: Guideline files stored in .ai/guidelines/ and domain-specific skills in .ai/skills/.
  • Boundary markers: None explicitly defined in the skill instructions; it relies on the developer to manage content within the .ai/ directory.
  • Capability inventory: The integrated MCP server provides tools for database schema inspection, execution of database queries, and log entry retrieval, which are high-privilege capabilities intended for development context.
  • Sanitization: No explicit sanitization mechanisms are described for the custom instruction files provided to the agent.
  • [SAFE]: The skill is primarily instructional and documentation-focused. It does not contain obfuscated code, hidden URLs, persistence mechanisms, or unauthorized credential exfiltration patterns. The tools and commands described are consistent with its stated purpose of improving AI development workflows in Laravel projects.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 01:39 AM