wp-phpstan
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script (scripts/phpstan_inspect.mjs) to analyze the project environment. It also suggests standard development commands such as 'composer run phpstan' and 'vendor/bin/phpstan analyse' to verify the static analysis configuration.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled project configuration files, which is a standard surface for indirect prompt injection.\n
- Ingestion points: The agent reads phpstan.neon, phpstan.neon.dist, phpstan-baseline.neon, and composer.json from the project directory.\n
- Boundary markers: No explicit instruction delimiters or 'ignore embedded instructions' warnings are provided when processing these external configuration files.\n
- Capability inventory: The skill utilizes local node scripts for environment inspection, composer for dependency management, and the phpstan binary for code analysis.\n
- Sanitization: No explicit sanitization or validation of the configuration file content is mentioned, though the skill directs the agent to confirm new dependency additions with the user.
Audit Metadata