Yaf Php Audit

Audit legacy PHP projects, especially Yaf-based PHP 7.3 codebases, for architecture issues, security risks, performance problems, compatibility risks, and ma...

This skill is coherent and appears to do what it says: local grep-based scanning and report generation for PHP/Yaf projects. Before using it, consider: 1) only run it against directories you intend to scan (it will recursively read project files and may surface secrets found in code into its reports); 2) choose a secure output directory (reports may contain snippets or matches that reveal API keys/passwords); 3) treat findings as first-pass heuristics — false positives/negatives are expected and manual review is required; 4) inspect the two provided scripts (scan_project.sh, scan_workspace.sh) if you have strict security policies — they are plain shell and do not perform network I/O. If you need the agent to audit sensitive repositories, ensure appropriate access controls and that report outputs are stored securely.

Type: OpenClaw Skill Name: yaf-php-audit Version: 1.2.0 The yaf-php-audit bundle is a legitimate static analysis tool designed to assist an AI agent in auditing legacy PHP projects. The included bash scripts (scan_project.sh and scan_workspace.sh) use standard utilities like grep and find to identify potential security vulnerabilities, performance bottlenecks, and hardcoded credentials within a target directory. There is no evidence of data exfiltration, intentional backdoors, or malicious prompt injection; the logic is transparent and strictly aligned with the stated purpose of generating structured audit reports.