perfex-module-dev
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides view templates that interpolate data (e.g.,
<h1><?= $title ?></h1>inviews/my_module/index.php) without demonstrating output escaping or sanitization practices (such as usinghtml_escape()). This represents a potential vulnerability surface where untrusted data could be rendered in the browser. - Ingestion points: View files in the
views/directory that process variables passed from controllers. - Boundary markers: No delimiters or escaping functions are present in the provided view examples.
- Capability inventory: Modules in this framework have broad capabilities, including database access via
$CI->dband file system operations via the CodeIgniter loader. - Sanitization: Sanitization/escaping functions are absent in the provided view template snippets.
- [COMMAND_EXECUTION]: The skill documents the
register_cron_taskfunction inmy_module.php, which enables modules to register and execute logic automatically via the system's cron scheduler.
Audit Metadata