php-exploit-chain
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill acts as an instructional framework for PHP security auditing, detailing how to link vulnerabilities like SQL injection, file inclusion, and deserialization into functional exploit chains for risk assessment.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external vulnerability reports and evidence (EVID_*) provided during the auditing process. This creates a surface for indirect injection if the source data is malicious, though this is inherent to the skill's purpose as a security analysis tool.
- Ingestion points: Vulnerability lists and EVID_* evidence paths.
- Boundary markers: None explicitly defined in the methodology text.
- Capability inventory: Analysis involves text processing, logical mapping of vulnerabilities, and dependency checks via external tools.
- Sanitization: Not explicitly mentioned; relies on the agent's analytical logic.
- [EXTERNAL_DOWNLOADS]: The skill references well-known and trusted external resources for dependency auditing, including Packagist Security Advisories, NVD, and GitHub Advisory databases. These are standard industry references for vulnerability research.
Audit Metadata