laravel-13-app-guidelines
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute standard development commands including
php artisan about,composer show, andvendor/bin/pint. These are used for environment detection and linting within the project scope. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from repository-level configuration files.
- Ingestion points: Files such as
AGENTS.md,CLAUDE.md,composer.json, andpackage.jsonare read to determine project conventions (SKILL.md, Workflow Steps 1 & 2). - Boundary markers: The instructions do not define clear delimiters or include warnings to ignore instructions embedded within these external files.
- Capability inventory: The agent has the capability to execute shell commands (
php artisan,composer), perform database operations, and modify the filesystem (controllers, migrations, tests). - Sanitization: No specific sanitization or validation of the content within these repository files is mandated before processing.
- [SAFE]: All external documentation and software references (e.g., laravel.com, inertiajs.com, github.com/laravel) target well-known and trusted service providers within the PHP/Laravel ecosystem.
Audit Metadata