php-lsp
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
intelephensepackage from the public npm registry. This is a standard and well-known tool for PHP development. - [COMMAND_EXECUTION]: The agent is guided to use the
run_commandtool to executeintelephensefor syntax verification and diagnostic purposes. - [INDIRECT_PROMPT_INJECTION]: The skill exposes the agent to untrusted external data which could potentially contain malicious instructions.
- Ingestion points: Untrusted data enters the context when the agent reads or analyzes
.phpfiles in the user's workspace (SKILL.md). - Boundary markers: Absent; the instructions do not provide delimiters to separate untrusted file content from the agent's instructions.
- Capability inventory: The agent is authorized to perform shell command execution via
run_command(SKILL.md). - Sanitization: Absent; the skill lacks requirements for sanitizing file content or filtering the output of the language server tool.
Audit Metadata