laravel-pro
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements best practices for secret management by recommending encrypted environment files and integration with secure external vaults such as AWS Secrets Manager and HashiCorp Vault.
- [SAFE]: Multi-tenancy guidelines emphasize data isolation using Laravel Global Scopes, which is a standard method for preventing unauthorized cross-tenant data access.
- [SAFE]: The skill incorporates modern security defenses, specifically suggesting the use of Content Security Policy (CSP) and temporary signed URLs for sensitive file access.
- [SAFE]: External references to GitHub and Stripe APIs are used for demonstration purposes in code examples and target well-known, trusted services.
- [INDIRECT_PROMPT_INJECTION]: The skill describes patterns that involve processing external data from user requests and third-party API responses.
- Ingestion points: Controller methods and concurrent HTTP response handling.
- Boundary markers: Not explicitly detailed in the provided architectural snippets.
- Capability inventory: Capabilities are limited to standard backend logic, database interactions, and HTTP client operations; no dangerous dynamic execution primitives were found.
- Sanitization: Promotes robust data handling via Laravel's native validation logic and Data Transfer Objects (DTOs).
Audit Metadata