easy-admin-bundle
Pass
Audited by Gen Agent Trust Hub on Mar 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute standard Symfony development commands such as 'composer require', 'symfony', and 'php bin/console'. These are legitimate tools for project scaffolding and package management.
- [EXTERNAL_DOWNLOADS]: The skill references the installation of the 'easycorp/easyadmin-bundle' and 'symfony/ux-autocomplete' packages. These are fetched from the official Composer registry, which is a well-known service for PHP development.
- [PROMPT_INJECTION]: The documentation identifies methods for rendering raw HTML in the administrative interface, such as 'renderAsHtml()' and 'escapeHtml(false)'. This identifies an indirect prompt injection surface.
- Ingestion points: Entity data fields (e.g., Product names, descriptions) as documented in 'SKILL.md' and 'references/fields.md'.
- Boundary markers: No delimiters or boundary warnings are present in the provided code snippets.
- Capability inventory: The agent has access to shell commands via Bash and file system operations.
- Sanitization: The provided examples demonstrate how to enable raw HTML rendering but do not include explicit sanitization or escaping logic for these specific use cases.
Audit Metadata