PHP · For developers

Insecure deserialization detection and gadget chain exploitation

NeoTheCapt/RedteamAgent

PHP Standards Recommendations (PSR) overview knowledge base.

dykyi-roman/awesome-claude-code

ClusteringService, tile keys, dirty tiles/teams, clustering commands, ClusterController GeoJSON API, PhotoObserver dirty marking, and map cluster rendering.

OpenLitterMap/openlittermap-web

Investigate an existing non-Mendix application (Java, .NET, Python, Node, PHP, …) and produce a structured migration assessment for Mendix.

mendixlabs/mxcli

Review WooCommerce hooks, product data, template overrides, escaping, and regression risks.

harukiseller-droid/commerce-agent-bench

Maintain gateway event handlers — payload hydration, cache mutation, event return shapes, and handler registration.

discord-php/DiscordPHP

PHP Web 源码文件上传审计工具。识别上传入口与保存路径、文件名处理与校验逻辑，检测任意文件上传/路径穿越/可执行上传风险，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

SOLID principles knowledge base for PHP 8.4 projects. An agent skill from dykyi-roman/awesome-claude-code.

dykyi-roman/awesome-claude-code

Code review automation for TypeScript, JavaScript, Python, Go, Swift, Kotlin, C, .NET, Java, C, C++, Rust, Ruby, PHP, and Dart/Flutter.

alirezarezvani/claude-skills

LeaderboardController, Redis sorted sets for all-time XP rankings, per-user metrics rows for time-filtered rankings, rewardXpToAdmin, and leaderboard privacy.

OpenLitterMap/openlittermap-web

Manage the lerd local PHP development environment via MCP tools: run framework console commands (artisan, bin/console, etc.), manage services, start/stop queue workers, run composer, manage Node.js…

liberusoftware/real-estate-laravel

Drives php bin/console monorepo:release end-to-end. An agent skill from shopsys/shopsys.

shopsys/shopsys

Maintain interaction flow — Interaction typing, resolved data caching, command routing, autocomplete, modal responses, and interaction builders.

discord-php/DiscordPHP

baserCMS 5系（CakePHP 5.0.5系）＋ jQuery プロジェクトの共通ルール（環境・ディレクトリ構成・命名規則・ログ／エラーハンドリング・コアハック禁止・サーバ制約）を定めた基底スキル。「baserCMS 5 で開発」「5系プロジェクトの構成・規約を確認」「htdocs/plugins 配下の配置」「CakeLog…

baserproject/basercms

Analyze cryptographic code to detect operations that leak secret data through execution timing variations.

sickn33/agentic-awesome-skills

Countries, states, cities, ResolveLocationAction, Location base model, LocationType enum, geocoding, and location-level Redis data.

OpenLitterMap/openlittermap-web

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching…

github/awesome-copilot

A skill your agent uses when building PHP applications with modern PHP 8.3+ features, Laravel, or Symfony frameworks.

AratKruglik/claude-laravel

PHP 文件系统操作审计工具。聚焦 mkdir/chmod/chown/unlink/rmdir/link/symlink/readlink/touch/权限与 TOCTOU 等操作的安全风险，为路径校验绕过与写入链利用提供“可利用性增强证据”（不替代 FILE/UPLOAD/WRITE 等 sink 子审计）。

0xShe/PHP-Code-Audit-Skill

baserCMS 5系（CakePHP 5ベース）のプラグインを新規開発・改修する際の正本パターン集。「プラグインを作成」「bcplugin で bake」「管理画面を追加」「Table/Entity の書き方」「initialize でアソシエーション宣言」「validationDefault」「fetchTable と TableRegistry の使い分け」「BcAdminForm /…

baserproject/basercms

Build Livewire 4 components and applications. An agent skill from freekmurze/dotfiles.

freekmurze/dotfiles

Spatie's PHP, Laravel, JavaScript and Vue coding guidelines and conventions.

freekmurze/dotfiles

Guide for creating PHP and Laravel packages using Spatie's package-skeleton-laravel and package-skeleton-php templates.

freekmurze/dotfiles

HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks.

langbyyi/CyberStrikeAI-SRC

Generate a complete PHP Model Context Protocol server project with tools, resources, prompts, and tests using the official PHP SDK

github/awesome-copilot

MetricsService, RedisMetricsCollector, ProcessPhotoMetrics, metrics table, Redis stats, leaderboards, XP processing, and photo processing state (processedat/fp/tags/xp).

OpenLitterMap/openlittermap-web

Complete WordPress development workflow covering theme development, plugin creation, WooCommerce integration, performance optimization, and security hardening.

sickn33/agentic-awesome-skills

WordPress plugin development workflow covering plugin architecture, hooks, admin interfaces, REST API, security best practices, and WordPress 7.0 features: Real-Time Collaboration, AI Connectors…

sickn33/agentic-awesome-skills

Maintain Repository classes — REST endpoints, route vars, cache coherence, typed collections, and persistence boundaries.

discord-php/DiscordPHP

Generates production-grade Selenium WebDriver automation scripts and tests in Java, Python, JavaScript, C, Ruby, or PHP.

sickn33/agentic-awesome-skills

Language-specific super-code guidelines for php. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Laravel 框架特效安全审计工具。针对 Laravel 常见鉴权/CSRF/Session/模型填充/Blade 渲染等框架特性进行白盒静态审计，并将风险映射到你现有通用漏洞类型体系（AUTH/CSRF/LOGIC/XSS/CFG 等）。

0xShe/PHP-Code-Audit-Skill

PHP Web 源码 SQL 注入漏洞审计工具。从源码中识别所有 SQL 执行点并分析注入风险，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

PHP Web 源码 SSRF 审计工具。识别用户可控 URL/地址进入网络请求 Sink，追踪内网/协议/端口限制与回显，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

Symfony 框架特效安全审计工具。针对 Symfony 常见 security.yaml、CSRF、Twig/Twig raw、表达式与访问控制等框架机制做白盒静态审计，并将风险映射到通用漏洞类型体系（AUTH/CSRF/CFG/XSS/TPL/LOGIC 等）。

0xShe/PHP-Code-Audit-Skill

ThinkPHP 框架特效安全审计工具。针对 ThinkPHP 常见的鉴权/CSRF/模板转义/ORM 写入（Mass Assignment）/调试与配置暴露等机制进行白盒静态审计，并映射到通用漏洞类型体系（AUTH/CSRF/TPL/XSS/LOGIC/CFG/SESS/SQL 等）。

0xShe/PHP-Code-Audit-Skill

WordPress 框架特效安全审计工具。针对 WordPress 常见 nonce/capability/checkadminreferer、AJAX action、escape/sanitize、重定向、安全上传与远程请求等机制进行白盒静态审计，并映射到通用漏洞类型体系（AUTH/CSRF/XSS/SQL/CFG/SSRF 等）。

0xShe/PHP-Code-Audit-Skill

Yii 框架特效安全审计工具。针对 Yii（通常指 Yii2）访问控制（AccessControl/RBAC）、CSRF、输入过滤规则、输出编码策略、URL/重定向安全等进行白盒静态审计，并映射到通用漏洞类型体系（AUTH/CSRF/XSS/CFG/LOGIC 等）。

0xShe/PHP-Code-Audit-Skill

baserCMS 5系（CakePHP 5ベース）のテーマを新規開発・改修する際の正本パターン集。「テーマを作成」「テーマプラグインの構造」「layout/element の書き方」「固定ページテンプレート（$page-contents）」「ウィジェット element の配置（element/widget）」「メールフォームテンプレート（createMailForm /…

baserproject/basercms

通过LaraPlugins.io MCP发现和评估Laravel包。当用户想要查找插件、检查包的健康状况或评估Laravel/PHP兼容性时使用。

affaan-m/ECC

Mine errorlog for creds, paths, SQL when leak hunt finds. An agent skill from uphiago/recon-skills.

uphiago/recon-skills

Action-Domain-Responder pattern knowledge base. An agent skill from dykyi-roman/awesome-claude-code.

dykyi-roman/awesome-claude-code

PHP Web 源码 CSRF 审计工具。识别状态变更接口是否受 CSRF 保护，追踪 token 生成、校验与绕过条件，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

PHP Web 源码 NoSQL 注入审计工具。识别用户输入进入 MongoDB/DocumentDB 查询构造，分析是否存在 operator 注入（$gt/$ne/$where 等），输出分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

PHP Web 源码会话与 Cookie 安全审计工具。识别 session 固定、Cookie flags 不安全、JWT 验证缺陷与记住登录风险，输出分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

PHP Web 源码 XSS 审计工具。识别用户输入进入输出上下文（HTML/属性/JS/URL/模板），分析转义与防护策略，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

PHP type juggling and weak comparison (==) bypass. An agent skill from langbyyi/CyberStrikeAI-SRC.

langbyyi/CyberStrikeAI-SRC

XSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces.

langbyyi/CyberStrikeAI-SRC