payloads-ext-var
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a documentation resource for security researchers and developers to understand and test for PHP variable extraction vulnerabilities (CWE-473, CWE-621).
- [EXTERNAL_DOWNLOADS]: The skill provides links to well-known security repositories such as PayloadsAllTheThings on GitHub, and official documentation from PHP.net and MITRE's CWE database. These are informational references used for research and do not involve the automated downloading or execution of untrusted scripts.
- [COMMAND_EXECUTION]: While the skill describes payloads that could be used in commands (e.g., curl requests), these are provided as plain-text examples for manual testing and are not executed by the skill itself.
- [INDIRECT_PROMPT_INJECTION]: The skill contains payload strings intended for security testing. While these are untrusted data patterns, they are clearly presented as research material within a reference framework and do not contain instructions aimed at subverting the AI agent's own safety protocols.
Audit Metadata