php-expr-audit

Name: php-expr-audit
Availability: InStock
Author: 0xShe

Detect user-controlled expressions reaching PHP expression engines and eval entry points.

386|38|Updated Mar 24, 2026

Search Tags:#security #php #static-analysis #code-review #security-audit #eval #expression-injection

Ready to run

npx skills add https://github.com/0xShe/PHP-Code-Audit-Skill --skill php-expr-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: php-expr-audit
Source: https://github.com/0xShe/PHP-Code-Audit-Skill/tree/main/php-expr-audit
Command: npx skills add https://github.com/0xShe/PHP-Code-Audit-Skill --skill php-expr-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill analyzes PHP source code to identify user-controlled expressions that reach expression engines or PHP dynamic execution points, enabling potential code execution or secret logic manipulation.

Core Features & Use Cases

Detects expression evaluation or compilation entry points such as ExpressionLanguage->evaluate({value}) and ExpressionLanguage->compile({value}) as well as PHP runtime execution via eval($code) and assert($assertion) when user input can influence code.
Identifies sources of user-controlled input that feed into expression strings and checks for unsafe concatenation or over-permissive evaluation contexts.
Provides structured reports with severity ratings, PoC guidance, and remediation recommendations for common PHP expression injection patterns in code reviews or CI pipelines.

Quick Start

Run the PHP expression-audit scanner against your codebase to locate and report all expression-evaluation entry points.

Frequently Asked Questions about php-expr-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit PHP code for expression injection vulnerabilities?▼

Detecting expression injection in PHP involves tracing user-controlled input to dynamic execution points like eval() or ExpressionLanguage->evaluate(). This scanner identifies these expression evaluation entry points and outputs structured remediation guidance.

What is expression injection in PHP applications?▼

Expression injection in PHP occurs when user-controlled input reaches expression engines or dynamic execution functions, enabling potential code execution or secret logic manipulation. It often involves unsafe concatenation within over-permissive evaluation contexts.

How do I integrate static code analysis for PHP expression injection into a CI pipeline?▼

Integrating static analysis into a CI pipeline flags expression-evaluation entry points during builds. Running the scanner against your codebase locates ExpressionLanguage and eval() risks, outputting structured reports with severity ratings to prevent deployment of vulnerable code.

Does this scanner detect eval and assert execution risks in PHP code reviews?▼

Yes, the scanner detects PHP runtime execution via eval($code) and assert($assertion) during code reviews. It identifies sources of user-controlled input feeding into these execution chains and checks for unsafe concatenation or over-permissive evaluation contexts.

What are the limitations of static analysis for PHP expression injection?▼

Static analysis for PHP expression injection focuses on detecting EXPR_EVAL_ENTRY, EXPR_CONTROL, and EXPR_EXEC_CHAIN_ENTRY traces in source code. It may not cover dynamic execution points obscured by complex runtime dependencies or heavily obfuscated data flows.