php-audit-pipeline
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill mentions and provides command-line examples for installing and running industry-standard security tools such as Semgrep, SonarQube, Psalm, and Snyk. These are well-known services and the references are provided as part of a documented auditing toolchain for PHP applications.
- [COMMAND_EXECUTION]: The documentation includes shell command examples for tool installation (pip, composer) and container execution (docker). These commands are intended for the auditor's environment and represent standard procedures for security analysis.
- [INDIRECT_PROMPT_INJECTION]: As a code auditing skill, it is designed to process untrusted external data (PHP source code). The skill explicitly implements an 'Evidence Contract' system to mitigate AI hallucinations and ensures that findings are backed by documented data flow evidence.
- Ingestion points: PHP source code files, configuration files (Laravel/ThinkPHP), and tool output (Phase 1 and Phase 3 in SKILL.md).
- Boundary markers: The 'references/evidence-contract.md' mandates structured evidence (EVID_*) to separate analysis from raw input data.
- Capability inventory: The skill describes the use of file system reading and external SAST tools (Semgrep, Psalm, Snyk) via shell commands (references/sast-toolchain.md).
- Sanitization: The methodology requires manual verification of data flow paths and filtration logic, ensuring that tool outputs are not blindly trusted (Phase 3 in SKILL.md).
Audit Metadata