php-attributes
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill directs the agent to ingest and analyze untrusted project data (e.g., version files, project conventions) to inform its actions. This creates an indirect prompt injection surface where malicious instructions embedded in a project's codebase could attempt to influence the agent's behavior.
- Ingestion points: Detection of Laravel/PHP versions, package managers, and existing project conventions from the local environment (SKILL.md).
- Boundary markers: The instructions do not explicitly mandate delimiters when reading external project files, though they do advise on maintaining clear boundaries for authorization and validation.
- Capability inventory: The skill assumes the underlying agent has capabilities to read file systems and execute tests to verify behavior.
- Sanitization: Includes guidelines to ensure logs and errors do not expose secrets or personal data, providing a degree of output sanitization.
Audit Metadata