PHP · For developers

Detect and exploit local and remote file inclusion vulnerabilities for sensitive data access and code execution

NeoTheCapt/RedteamAgent

MallBase 数据库真相源、正式字段与升级 SQL 规则；修改 backend/install/data/schema 或 demo seed、新增/改名字段、移除运行时字段探测，或用户明确要求已有库升级、本地 upgrade SQL、发布迁移和 SimpleSqlMigrationService 时使用。

yyw-code/MallBase

DDD architecture knowledge base. An agent skill from dykyi-roman/awesome-claude-code.

dykyi-roman/awesome-claude-code

Mass scan for exposed env files, backups, and git configs. An agent skill from uphiago/recon-skills.

uphiago/recon-skills

ProfileController, ApiSettingsController, DeleteAccountController, user stats (Redis + MySQL fallback), LevelService, privacy toggles, account deletion with Redis cleanup, and the Profile Vue page.

OpenLitterMap/openlittermap-web

Language-specific patterns and tooling: Go, Kotlin, PHP, Swift, TypeScript.

notque/vexjoy-agent

Comprehensive guide for developing on EspoCRM - metadata-driven CRM with service layer architecture

bobmatnyc/claude-mpm

WordPress plugin development with hooks, security, REST API, custom post types.

secondsky/claude-skills

Use only for explicit legacy GEOFlow template skill questions, old PHP template-package contracts, or historical outputs using root index.php/article.php/category.php/archive.php and includes/.php.

yaojingang/yao-geo-skills

Guidance for writing and running tests in Simple History, including the Premium add-on.

bonny/WordPress-Simple-History

Scan a source tree for command-injection vulnerable patterns: shell=True calls in Python subprocess, os.system / os.popen with interpolated strings, Node childprocess.exec with template literals…

jeremylongshore/tons-of-skills-marketplace

Scan a source tree for dynamic-code-execution APIs that an attacker can hijack: Python eval / exec / compile, JavaScript eval / Function() / setTimeout(string), Ruby eval / instanceeval / classeval…

jeremylongshore/tons-of-skills-marketplace

Scan a source tree for unsafe-by-default deserialization APIs: Python pickle.loads / cPickle / shelve / dill, Ruby Marshal.load / YAML.load (pre-3.1 default), Java ObjectInputStream.readObject, PHP…

jeremylongshore/tons-of-skills-marketplace

PhotoTag, PhotoTagExtraTags, categories, litter objects, materials, brands, ClassifyTagsService, GeneratePhotoSummaryService, tag migration, and the v4-to-v5 conversion.

OpenLitterMap/openlittermap-web

Provides WordPress theme development patterns using Sage (roots/sage) framework.

giuseppe-trisciuoglio/developer-kit

Hunt Insecure Deserialization

sickn33/agentic-awesome-skills

Hunt file upload bugs

sickn33/agentic-awesome-skills

Operational guide for implementing a new Envilder runtime SDK.

macalbert/envilder

Coding principles and conventions for this Shopsys project — DRY/KISS/reuse, comment and docblock quality, test-code rules, the project visibility/typing rules, and documentation best practices.

shopsys/shopsys

Create or extend an administration CRUD controller (list / detail / create / edit / delete pages for an entity) built on Shopsys\AdministrationBundle\Controller\AbstractCrudController.

shopsys/shopsys

The command catalog for this Shopsys project — how to build, run, test, check code, access the database, and sync the GraphQL schema, including the macOS Mutagen workflow.

shopsys/shopsys

Insecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node.

Encod3d-Sec/TORCH

Build and upgrade PHP/Laravel applications with validated requests, policy authorization and reliable jobs/data access.

WrongStack/WrongStack

WordPress block editor code review and Gutenberg block development patterns for WordPress 6.x+.

jorgerosal/wordpress-skills

WordPress plugin architecture review and WordPress.org submission standards.

jorgerosal/wordpress-skills

WordPress security code review and vulnerability detection. An agent skill from jorgerosal/wordpress-skills.

jorgerosal/wordpress-skills

WordPress theme code review and block theme development patterns for WordPress 6.6+.

jorgerosal/wordpress-skills

Saga Pattern knowledge base. An agent skill from dykyi-roman/awesome-claude-code.

dykyi-roman/awesome-claude-code

Writing and fixing tests, test factories, Event::fake patterns, auth guard testing, PHPUnit configuration, deprecated test groups, and common test pitfalls.

OpenLitterMap/openlittermap-web

The olm:v5 migration script, UpdateTagsService, batch processing, migratedat, ClassifyTagsService deprecated mappings, and data migration from v4 category tables.

OpenLitterMap/openlittermap-web

Audit PHP web application source for critical vulnerabilities using PHP's specific sink and footgun catalog — object injection via unserialize and phar:// POP chains, type-juggling and magic-hash…

trilwu/secskills

Select and wrap BambooHR's official Python or PHP SDK, or a narrow direct HTTP adapter, with tenant isolation and typed errors.

jeremylongshore/tons-of-skills-marketplace

baserCMS 4 (CakePHP 2ベース) のコード・サイトを baserCMS 5 (CakePHP 5ベース) へアップグレード／移行する際に AIエージェントが遵守すべきルールとパターン集。「baserCMS 4 から 5 へ移行」「4系を5系にアップグレード」「BcDbMigrator でデータ移行」「BcAddonMigrator でテーマ／プラグイン変換」「CakePHP…

baserproject/basercms

A skill your agent uses when building or extending a Laravel 11/12 app — Eloquent models, migrations and relationships, routing with controllers and Form Requests, queues and background jobs…

ericrisco/rsc-harness

A skill your agent uses when writing, reviewing or modernizing PHP (8.3-8.5) outside Laravel — strict types, union and intersection types, readonly classes, backed enums, property hooks and…

ericrisco/rsc-harness

A skill your agent uses when building or customizing a Shopify store across its three code surfaces — themes (Liquid, Online Store 2.0 sections, blocks and JSON templates), apps (Remix with the…

ericrisco/rsc-harness

A skill your agent uses when building or hardening WordPress sites or WooCommerce stores and treating WordPress as the product rather than just writing PHP — block themes with theme.json, plugins…

ericrisco/rsc-harness

CTF 挑战中的源码审计方法。当发现 .git 目录、.bak/.zip 备份、/proc/self/environ 泄露源码时使用。与真实代码审计不同——CTF 源码中的漏洞是故意设置的，通常只有 1-2 个关键点。先找危险函数（sink），再追溯输入（source）到该函数的路径。覆盖 PHP/Python/Node.js/Java 四种语言的危险函数和漏洞模式

wgpsec/AboutSecurity

Provides AWS Lambda integration patterns for PHP with Symfony using the Bref framework.

giuseppe-trisciuoglio/developer-kit

Provides implementation patterns for Clean Architecture, Hexagonal Architecture (Ports & Adapters), and Domain-Driven Design in PHP 8.3+ with Symfony 7.x.

giuseppe-trisciuoglio/developer-kit

Build REST endpoints with API Resources, Sanctum authentication, and versioned route groups in Laravel.

HoangNguyen0403/agent-skills-standard

Build scalable asynchronous workflows using Queues, Jobs, and Events in Laravel.

HoangNguyen0403/agent-skills-standard

Implement Domain-Driven Design with typed DTOs, repository interfaces, and single-responsibility Action classes in Laravel.

HoangNguyen0403/agent-skills-standard

Harden Laravel apps with Policies for model authorization, Gate-based RBAC, validated mass assignment, and CSRF protection.

HoangNguyen0403/agent-skills-standard

Configure Redis session drivers, register security-header middleware, and prevent session fixation in Laravel.

HoangNguyen0403/agent-skills-standard

Configure Laravel ecosystem with custom Artisan commands, Vite asset bundling, Pint code styling, and Horizon queue monitoring.

HoangNguyen0403/agent-skills-standard

Write PHP following PSR coding standards, SOLID principles, and code-quality guidelines.

HoangNguyen0403/agent-skills-standard

Apply core PHP language standards and modern 8.x features. An agent skill from HoangNguyen0403/agent-skills-standard.

HoangNguyen0403/agent-skills-standard