Existing behavior: project images may attack while polymorphed such as via the polymorph self or shapechange spells. Adding an effect with opcode 1 to set the number of attacks to 0 does not work because the engine seems to override the number of attacks while polymorphed. This is hardcoded, and there is no way to override this behavior short of not allowing projected images be polymorphed.
Expected behavior: project images may polymorph into different forms to retain locomotion or resistances for example but they should still be unable to attack.
How to test this: cast project image with either shapechange or polymorph self memorized. Then have the duplicate cast either spell and polymorph into any form.