php-principles
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill references the use of standard PHP development tools, including
phpstan,psalm,pest,phpunit, andcomposer audit. These tools are invoked locally for static analysis, unit testing, and dependency auditing, which are standard practices in software development environments. - [INDIRECT_PROMPT_INJECTION]: This skill operates by analyzing and refactoring PHP code, which represents untrusted data. While it recommends using verification tools, the lack of explicit instruction boundary markers in the guidelines for processing these files creates a potential surface for indirect prompt injection, typical of code-analysis skills.
- Ingestion points: PHP source code files, class designs, and dependency lists (SKILL.md).
- Boundary markers: None explicitly defined in the instructions.
- Capability inventory: Local execution of testing and analysis tools via
vendor/bin/(SKILL.md). - Sanitization: None specified for the code being reviewed.
Audit Metadata