The Agent Skills Directory

[COMMAND_EXECUTION]: Executes ./vendor/bin/psalm within the project directory to perform security scans. This is a standard practice for PHP static analysis and uses the local project context.
[EXTERNAL_DOWNLOADS]: Mentions installing vimeo/psalm via Composer. This is the official and well-known repository for the Psalm tool.
[INDIRECT_PROMPT_INJECTION]: The skill processes JSON output from the Psalm scanner. While the code being scanned is external data, the structured JSON format and the specific purpose of security reporting minimize risks of instructions being obeyed from the scanned content.
Ingestion points: Reads psalm-results.json generated from the project source code.
Boundary markers: None explicitly defined in the output formatting instructions.
Capability inventory: Executes shell commands to run the scanner.
Sanitization: Not applicable as it is reporting findings from a security tool.

sast-psalm