hyva-cms-components-dump
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONNO_CODE
Full Analysis
- [COMMAND_EXECUTION] (MEDIUM): The skill instructs the agent to execute a local PHP script (
php <skill_path>/scripts/dump_cms_components.php). This facilitates command execution on the host system which could be exploited if the script contains malicious logic or is replaced by an attacker.- [NO_CODE] (LOW): The scriptscripts/dump_cms_components.phpwhich performs the actual file reading and merging logic is missing from the provided file list. The analysis is limited to the instructions in SKILL.md and cannot verify the safety of the underlying PHP code.- [DATA_EXPOSURE] (SAFE): The skill accessesapp/etc/config.phpandcomponents.jsonfiles within the Magento file structure. While these files contain system configuration and module metadata, they typically do not contain sensitive secrets like database credentials (which are stored inenv.phpin Magento), making this access pattern relatively low risk for its intended purpose.
Audit Metadata