PHP

Insecure deserialization detection and gadget chain exploitation

NeoTheCapt/RedteamAgent

MallBase ThinkPHP 后端分层、Swoole Service 无状态与 IDE 泛型规则；开发或重构 backend/app 下的 Controller、Service、Model，调整 BaseController/BaseService、service()/model() 调用、构造注入或协程安全状态时使用。

yyw-code/MallBase

baserCMS 4系（CakePHP 2.10ベース）＋ jQuery プロジェクトの開発ルール集。「baserCMS 4 で開発」「4系のプラグインを修正」「CakePHP 2系のコードを書く」「app/Plugin 配下の Controller／Model／View」「テーマの…

baserproject/basercms

Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel…

utkusen/sast-skills

PHP Standards Recommendations (PSR) overview knowledge base.

dykyi-roman/awesome-claude-code

A skill your agent uses when working with the WordPress Abilities API (wpregisterability, wpregisterabilitycategory, /wp-json/wp-abilities/v1/, @wordpress/abilities) including defining abilities…

gambitph/Stackable

ClusteringService, tile keys, dirty tiles/teams, clustering commands, ClusterController GeoJSON API, PhotoObserver dirty marking, and map cluster rendering.

OpenLitterMap/openlittermap-web

Investigate an existing non-Mendix application (Java, .NET, Python, Node, PHP, …) and produce a structured migration assessment for Mendix.

mendixlabs/mxcli

Review WooCommerce hooks, product data, template overrides, escaping, and regression risks.

harukiseller-droid/commerce-agent-bench

Maintain gateway event handlers — payload hydration, cache mutation, event return shapes, and handler registration.

discord-php/DiscordPHP

PHP Web 源码文件上传审计工具。识别上传入口与保存路径、文件名处理与校验逻辑，检测任意文件上传/路径穿越/可执行上传风险，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

SOLID principles knowledge base for PHP 8.4 projects. An agent skill from dykyi-roman/awesome-claude-code.

dykyi-roman/awesome-claude-code

Code review automation for TypeScript, JavaScript, Python, Go, Swift, Kotlin, C, .NET, Java, C, C++, Rust, Ruby, PHP, and Dart/Flutter.

alirezarezvani/claude-skills

LeaderboardController, Redis sorted sets for all-time XP rankings, per-user metrics rows for time-filtered rankings, rewardXpToAdmin, and leaderboard privacy.

OpenLitterMap/openlittermap-web

Manage the lerd local PHP development environment via MCP tools: run framework console commands (artisan, bin/console, etc.), manage services, start/stop queue workers, run composer, manage Node.js…

liberusoftware/real-estate-laravel

Drives php bin/console monorepo:release end-to-end. An agent skill from shopsys/shopsys.

shopsys/shopsys

Maintain interaction flow — Interaction typing, resolved data caching, command routing, autocomplete, modal responses, and interaction builders.

discord-php/DiscordPHP

Turns a WordPress Site Health report into a risk-tiered, backup-first fix plan with exact WP-CLI/PHP snippets.

sickn33/agentic-awesome-skills

PHP Web 源码任意文件写入审计工具。识别用户可控数据进入写入 Sink 的链路，追踪任意落点写入/路径穿越到 write，并评估写入后的可执行性（禁止省略）。

0xShe/PHP-Code-Audit-Skill

MallBase ThinkPHP 列表查询与分页返回规则；实现或调整 Service 的 buildListQuery、分页 list/total、动态筛选、关联查询、统计、导出或 compact('total', 'list') 返回时使用。

yyw-code/MallBase

baserCMS 5系（CakePHP 5.0.5系）＋ jQuery プロジェクトの共通ルール（環境・ディレクトリ構成・命名規則・ログ／エラーハンドリング・コアハック禁止・サーバ制約）を定めた基底スキル。「baserCMS 5 で開発」「5系プロジェクトの構成・規約を確認」「htdocs/plugins 配下の配置」「CakeLog…

baserproject/basercms

Analyze cryptographic code to detect operations that leak secret data through execution timing variations.

sickn33/agentic-awesome-skills

Countries, states, cities, ResolveLocationAction, Location base model, LocationType enum, geocoding, and location-level Redis data.

OpenLitterMap/openlittermap-web

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching…

github/awesome-copilot

A skill your agent uses when building PHP applications with modern PHP 8.3+ features, Laravel, or Symfony frameworks.

AratKruglik/claude-laravel

Maintain the optional prefix-command layer — DiscordCommandClient, Command class, parsing, aliases, cooldowns, and help system.

discord-php/DiscordPHP

理解 LeoAI Java/PHP WebShell 与 Java 内存马生成链路，根据用户本次选择的通信、伪装、兼容性和混淆参数生成独立制品。用户要求生成、变体生成、调整兼容性或排查 Shell 无法连接时使用；始终通过 ShellGeneratorTools 完成确定性生成与结果交付。

cha0upup/LeoAI

PHP 文件系统操作审计工具。聚焦 mkdir/chmod/chown/unlink/rmdir/link/symlink/readlink/touch/权限与 TOCTOU 等操作的安全风险，为路径校验绕过与写入链利用提供“可利用性增强证据”（不替代 FILE/UPLOAD/WRITE 等 sink 子审计）。

0xShe/PHP-Code-Audit-Skill

MUST use when writing PHP scripts.

windmill-labs/windmill

baserCMS 5系（CakePHP 5ベース）のプラグインを新規開発・改修する際の正本パターン集。「プラグインを作成」「bcplugin で bake」「管理画面を追加」「Table/Entity の書き方」「initialize でアソシエーション宣言」「validationDefault」「fetchTable と TableRegistry の使い分け」「BcAdminForm /…

baserproject/basercms

Build Livewire 4 components and applications. An agent skill from freekmurze/dotfiles.

freekmurze/dotfiles

Spatie's PHP, Laravel, JavaScript and Vue coding guidelines and conventions.

freekmurze/dotfiles

Guide for creating PHP and Laravel packages using Spatie's package-skeleton-laravel and package-skeleton-php templates.

freekmurze/dotfiles

HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks.

langbyyi/CyberStrikeAI-SRC

Generate a complete PHP Model Context Protocol server project with tools, resources, prompts, and tests using the official PHP SDK

github/awesome-copilot

MetricsService, RedisMetricsCollector, ProcessPhotoMetrics, metrics table, Redis stats, leaderboards, XP processing, and photo processing state (processedat/fp/tags/xp).

OpenLitterMap/openlittermap-web

Complete WordPress development workflow covering theme development, plugin creation, WooCommerce integration, performance optimization, and security hardening.

sickn33/agentic-awesome-skills

WordPress plugin development workflow covering plugin architecture, hooks, admin interfaces, REST API, security best practices, and WordPress 7.0 features: Real-Time Collaboration, AI Connectors…

sickn33/agentic-awesome-skills

Maintain Repository classes — REST endpoints, route vars, cache coherence, typed collections, and persistence boundaries.

discord-php/DiscordPHP

Work with DiscordPHP's voice subsystem — voice gateway protocol opcodes, encryption (VoiceGroupCrypto), voice packets, audio streaming, and Discord.php voice integration.

discord-php/DiscordPHP

Generates production-grade Selenium WebDriver automation scripts and tests in Java, Python, JavaScript, C, Ruby, or PHP.

sickn33/agentic-awesome-skills

Language-specific super-code guidelines for php. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Laravel 框架特效安全审计工具。针对 Laravel 常见鉴权/CSRF/Session/模型填充/Blade 渲染等框架特性进行白盒静态审计，并将风险映射到你现有通用漏洞类型体系（AUTH/CSRF/LOGIC/XSS/CFG 等）。

0xShe/PHP-Code-Audit-Skill

PHP Web 源码 LDAP 注入审计工具。识别用户可控数据进入 LDAP filter/DN 构造并被 ldapsearch/ldapread 执行，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

PHP Web 安全日志与监控审计工具。识别安全事件缺失、敏感信息写入日志、日志注入/伪造风险，以及日志与告警链路缺陷，并输出可利用性分级、可观测 PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

PHP Web 业务逻辑漏洞审计工具。识别认证/授权以外的逻辑缺陷：Mass Assignment、流程绕过、竞态条件、状态机缺陷、支付/权限时序漏洞等，输出证据链、分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

PHP Web 源码路由与参数映射分析工具。从源码中提取所有入口路由与参数结构，输出完整请求模板与参数清单（禁止省略）。

0xShe/PHP-Code-Audit-Skill

PHP Web 路由到 Sink 的多层数据流追踪工具。根据用户指定路由，追踪从 handler 到最终敏感操作点，输出层级证据、参数变量追踪、可控性分析（不做漏洞结论）。

0xShe/PHP-Code-Audit-Skill