hyperf — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hyperf (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Hyperf 3.1 框架开发助手，专注于控制器、模型、命令行工具的快速开发。
# 生成控制器
php bin/hyperf.php gen:controller UserController
# 生成模型
php bin/hyperf.php gen:model User
# 生成命令
php bin/hyperf.php gen:command ImportCommand
# 生成中间件
php bin/hyperf.php gen:middleware AuthMiddleware
# 生成请求验证类
php bin/hyperf.php gen:request UserRequest
# 启动服务
php bin/hyperf.php start<?php
declare(strict_types=1);
namespace App\Controller;
use Hyperf\HttpServer\Annotation\Controller;
use Hyperf\HttpServer\Annotation\GetMapping;
#[Controller(prefix: "/api/users")]
class UserController extends AbstractController
{
#[GetMapping("")]
public function index()
{
return $this->response->json(['code' => 0, 'data' => []]);
}
}<?php
declare(strict_types=1);
namespace App\Model;
use Hyperf\DbConnection\Model\Model;
class User extends Model
{
protected ?string $table = 'users';
protected array $fillable = ['name', 'email'];
}<?php
declare(strict_types=1);
namespace App\Command;
use Hyperf\Command\Command as HyperfCommand;
use Hyperf\Command\Annotation\Command;
#[Command]
class ImportDataCommand extends HyperfCommand
{
protected ?string $name = 'import:data';
public function handle()
{
$this->info('Processing...');
}
}<?php
declare(strict_types=1);
namespace App\Service;
use App\Model\User;
class UserService
{
public function create(array $data): User
{
return User::create($data);
}
}详细文档请参考 references/zh-cn/ 目录下的官方文档：
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.