Security audit
Statamic Development
Security checks for vulnerabilities and agentic risk
Overview
This is a documentation-only Statamic CMS development skill with project-local examples and no hidden executable behavior.
Install this as a normal Statamic development reference. Review any agent-generated changes before applying them, especially edits to composer.json, package.json, service providers, routes, build output, or content files, because the skill can guide project mutations when you ask for implementation help.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.