Agent skill

Laravel Security

Buenas prácticas de seguridad en Laravel para autenticación/autorización, validación, CSRF, asignación masiva, subida de archivos, secretos, limitación de velocidad y despliegue seguro.

MITAuto-check passedBackend & APIs

Install Laravel Security

skills CLI

$ npx skills add affaan-m/ECC --skill laravel-security -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install affaan-m/ECC laravel-security --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .claude/skills && cp -r skills-src/docs/es/skills/laravel-security .claude/skills/laravel-security && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "laravel-security" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/es/skills/laravel-security into .claude/skills/laravel-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "laravel-security", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/affaan-m/ECC/tree/main/docs/es/skills/laravel-security

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add affaan-m/ECC --skill laravel-security -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install affaan-m/ECC laravel-security --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .agents/skills && cp -r skills-src/docs/es/skills/laravel-security .agents/skills/laravel-security && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "laravel-security" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/es/skills/laravel-security into .agents/skills/laravel-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "laravel-security", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add affaan-m/ECC --skill laravel-security -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install affaan-m/ECC laravel-security --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/docs/es/skills/laravel-security .cursor/skills/laravel-security && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "laravel-security" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/es/skills/laravel-security into .cursor/skills/laravel-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "laravel-security", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/affaan-m/ECC.git --path docs/es/skills/laravel-security

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add affaan-m/ECC --skill laravel-security -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install affaan-m/ECC laravel-security --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/docs/es/skills/laravel-security .gemini/skills/laravel-security && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "laravel-security" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/es/skills/laravel-security into .gemini/skills/laravel-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "laravel-security", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install affaan-m/ECC laravel-security

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add affaan-m/ECC --skill laravel-security -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .github/skills && cp -r skills-src/docs/es/skills/laravel-security .github/skills/laravel-security && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "laravel-security" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/es/skills/laravel-security into .github/skills/laravel-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "laravel-security", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add affaan-m/ECC --skill laravel-security -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install affaan-m/ECC laravel-security --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/docs/es/skills/laravel-security .opencode/skills/laravel-security && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "laravel-security" agent skill from https://github.com/affaan-m/ECC/tree/main/docs/es/skills/laravel-security into .opencode/skills/laravel-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "laravel-security", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: laravel-security
GitHub stars: 276k
Token cost: ~2.1k tokens
SKILL.md length: 589 words
Files: 1
Skills in repo: 683
Repo updated: Oct 10, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Buenas prácticas de seguridad en Laravel para autenticación/autorización, validación, CSRF, asignación masiva, subida de archivos, secretos, limitación de velocidad y despliegue seguro.

Tasks that involve Backend development
SKILL.md covers Cuándo Activar, Cómo Funciona, Configuración Principal de… and Reforzamiento de Sesión y…, plus 17 more sections
Calls composer; needs APP_KEY
Tasks that involve Web application vulnerabilities

What it does

Laravel Security is an agent skill from affaan-m/ECC. Buenas prácticas de seguridad en Laravel para autenticación/autorización, validación, CSRF, asignación masiva, subida de archivos, secretos, limitación de velocidad y despliegue seguro.

Its SKILL.md is about 2.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Backend & APIs, covering Backend development and Web application vulnerabilities. It works with Laravel. The repository describes itself as: The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond. The licence is MIT.

When your agent uses it

Tasks that involve Backend development
Tasks that involve Web application vulnerabilities

Example prompts

“Use the laravel-security skill to buena prácticas de seguridad en Laravel para autenticación/autorización, validación, CSRF, asignación masiva…”
“/laravel-security”

Requirements

A credential in APP_KEY

What it can do on your machine

Read from SKILL.md and the folder at commit 4eb71d9. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- composer
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
- APP_KEY
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Laravel Security loads about 2.1k tokens when it runs. Until then it costs about 51 tokens; SKILL.md has 589 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~51
When it runs · the whole SKILL.md, loaded when a task matches: ~2.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from affaan-m/ECC at commit 4eb71d9, republished under its MIT licence (© affaan-m). 589 words, ~2,052 tokens.

Download SKILL.mdSave it as .claude/skills/laravel-security/SKILL.md (or your agent's skills folder).

name: laravel-security
description: Buenas prácticas de seguridad en Laravel para autenticación/autorización, validación, CSRF, asignación masiva, subida de archivos, secretos, limitación de velocidad y despliegue seguro.
origin: ECC

Buenas Prácticas de Seguridad en Laravel

Guía completa de seguridad para aplicaciones Laravel que protege contra vulnerabilidades comunes.

Cuándo Activar

Agregar autenticación o autorización
Manejar entrada de usuarios y subida de archivos
Construir nuevos endpoints de API
Gestionar secretos y configuración de entornos
Reforzar despliegues en producción

Cómo Funciona

El middleware proporciona protecciones de base (CSRF mediante VerifyCsrfToken, cabeceras de seguridad mediante SecurityHeaders).
Los guards y policies aplican el control de acceso (auth:sanctum, $this->authorize, middleware de policy).
Los Form Requests validan y dan forma a la entrada (UploadInvoiceRequest) antes de que llegue a los servicios.
La limitación de velocidad agrega protección contra abusos (RateLimiter::for('login')) junto con controles de autenticación.
La seguridad de datos proviene de casts encriptados, guards de asignación masiva y rutas firmadas (URL::temporarySignedRoute + middleware signed).

Configuración Principal de Seguridad

APP_DEBUG=false en producción
APP_KEY debe estar establecido y rotarse al comprometerse
Establecer SESSION_SECURE_COOKIE=true y SESSION_SAME_SITE=lax (o strict para apps sensibles)
Configurar proxies de confianza para la detección correcta de HTTPS

Reforzamiento de Sesión y Cookies

Establecer SESSION_HTTP_ONLY=true para prevenir acceso desde JavaScript
Usar SESSION_SAME_SITE=strict para flujos de alto riesgo
Regenerar sesiones al iniciar sesión y al cambiar privilegios

Autenticación y Tokens

Usar Laravel Sanctum o Passport para autenticación de API
Preferir tokens de corta vida con flujos de actualización para datos sensibles
Revocar tokens al cerrar sesión y en cuentas comprometidas

Ejemplo de protección de rutas:

php

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;

Route::middleware('auth:sanctum')->get('/me', function (Request $request) {
    return $request->user();
});

Seguridad de Contraseñas

Hashear contraseñas con Hash::make() y nunca almacenar texto plano
Usar el password broker de Laravel para los flujos de restablecimiento

php

use Illuminate\Support\Facades\Hash;
use Illuminate\Validation\Rules\Password;

$validated = $request->validate([
    'password' => ['required', 'string', Password::min(12)->letters()->mixedCase()->numbers()->symbols()],
]);

$user->update(['password' => Hash::make($validated['password'])]);

Autorización: Policies y Gates

Usar policies para autorización a nivel de modelo
Aplicar autorización en controladores y servicios

php

$this->authorize('update', $project);

Usar middleware de policy para aplicación a nivel de ruta:

php

use Illuminate\Support\Facades\Route;

Route::put('/projects/{project}', [ProjectController::class, 'update'])
    ->middleware(['auth:sanctum', 'can:update,project']);

Validación y Sanitización de Datos

Siempre validar entradas con Form Requests
Usar reglas de validación estrictas y verificaciones de tipo
Nunca confiar en los payloads de la request para campos derivados

Protección contra Asignación Masiva

Usar $fillable o $guarded y evitar Model::unguard()
Preferir DTOs o mapeo explícito de atributos

Prevención de Inyección SQL

Usar Eloquent o el query builder con binding de parámetros
Evitar SQL crudo a menos que sea estrictamente necesario

php

DB::select('select * from users where email = ?', [$email]);

Show full SKILL.md (239 more words)Show less

Prevención de XSS

Blade escapa la salida por defecto ({{ }})
Usar {!! !!} solo para HTML de confianza y sanitizado
Sanitizar texto enriquecido con una librería dedicada

Protección CSRF

Mantener el middleware VerifyCsrfToken habilitado
Incluir @csrf en formularios y enviar tokens XSRF en requests de SPA

Para autenticación SPA con Sanctum, asegurarse de que las requests stateful estén configuradas:

php

// config/sanctum.php
'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', 'localhost')),

Seguridad en Subida de Archivos

Validar tamaño de archivo, tipo MIME y extensión
Almacenar subidas fuera del directorio público cuando sea posible
Escanear archivos en busca de malware si es necesario

php

final class UploadInvoiceRequest extends FormRequest
{
    public function authorize(): bool
    {
        return (bool) $this->user()?->can('upload-invoice');
    }

    public function rules(): array
    {
        return [
            'invoice' => ['required', 'file', 'mimes:pdf', 'max:5120'],
        ];
    }
}

php

$path = $request->file('invoice')->store(
    'invoices',
    config('filesystems.private_disk', 'local') // establecer a un disco no público
);

Limitación de Velocidad

Aplicar middleware throttle en endpoints de autenticación y escritura
Usar límites más estrictos para login, restablecimiento de contraseña y OTP

php

use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\RateLimiter;

RateLimiter::for('login', function (Request $request) {
    return [
        Limit::perMinute(5)->by($request->ip()),
        Limit::perMinute(5)->by(strtolower((string) $request->input('email'))),
    ];
});

Secretos y Credenciales

Nunca hacer commit de secretos al control de versiones
Usar variables de entorno y gestores de secretos
Rotar claves después de una exposición e invalidar sesiones

Atributos Encriptados

Usar casts encriptados para columnas sensibles en reposo.

php

protected $casts = [
    'api_token' => 'encrypted',
];

Cabeceras de Seguridad

Agregar CSP, HSTS y protección de frames donde sea apropiado
Usar configuración de proxies de confianza para forzar redirecciones HTTPS

Ejemplo de middleware para establecer cabeceras:

php

use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

final class SecurityHeaders
{
    public function handle(Request $request, \Closure $next): Response
    {
        $response = $next($request);

        $response->headers->add([
            'Content-Security-Policy' => "default-src 'self'",
            'Strict-Transport-Security' => 'max-age=31536000', // agregar includeSubDomains/preload solo cuando todos los subdominios sean HTTPS
            'X-Frame-Options' => 'DENY',
            'X-Content-Type-Options' => 'nosniff',
            'Referrer-Policy' => 'no-referrer',
        ]);

        return $response;
    }
}

CORS y Exposición de API

Restringir orígenes en config/cors.php
Evitar orígenes wildcard para rutas autenticadas

php

// config/cors.php
return [
    'paths' => ['api/*', 'sanctum/csrf-cookie'],
    'allowed_methods' => ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
    'allowed_origins' => ['https://app.example.com'],
    'allowed_headers' => [
        'Content-Type',
        'Authorization',
        'X-Requested-With',
        'X-XSRF-TOKEN',
        'X-CSRF-TOKEN',
    ],
    'supports_credentials' => true,
];

Logging y PII

Nunca registrar contraseñas, tokens o datos completos de tarjetas
Redactar campos sensibles en logs estructurados

php

use Illuminate\Support\Facades\Log;

Log::info('User updated profile', [
    'user_id' => $user->id,
    'email' => '[REDACTED]',
    'token' => '[REDACTED]',
]);

Seguridad de Dependencias

Ejecutar composer audit regularmente
Fijar dependencias con cuidado y actualizar rápidamente ante CVEs

URLs Firmadas

Usar rutas firmadas para enlaces temporales a prueba de manipulaciones.

php

use Illuminate\Support\Facades\URL;

$url = URL::temporarySignedRoute(
    'downloads.invoice',
    now()->addMinutes(15),
    ['invoice' => $invoice->id]
);

php

use Illuminate\Support\Facades\Route;

Route::get('/invoices/{invoice}/download', [InvoiceController::class, 'download'])
    ->name('downloads.invoice')
    ->middleware('signed');

Files

Just SKILL.md in docs/es/skills/laravel-security of affaan-m/ECC.

Open the folder on GitHubat commit 4eb71d9

Compare with similar skills

Laravel Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Laravel Security compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Laravel Security this skillaffaan-m/ECC	276k	—	~2.1k	Automated safety check: Pass	MIT	yesterday
Cashier Stripe Developmentluadotsh/lua	343	1 repos	~1.2k	Automated safety check: Pass	MIT	19 days ago
Spa Auth Developmentgdarko/laravel-vue-starter	145	—	~668	Automated safety check: Notes	MIT	6 mo ago
Php Laravel Audit0xShe/PHP-Code-Audit-Skill	402	1 repos	~821	Automated safety check: Pass	None	6 mo ago
Laravel SecurityHoangNguyen0403/agent-skills-standard	572	—	~887	Automated safety check: Pass	MIT	yesterday
Php Framework Auditwgpsec/AboutSecurity	1.8k	—	~767	Automated safety check: Notes	None	yesterday

Similar skills

Cashier Stripe Development
luadotsh/lua
Handles Laravel Cashier Stripe integration including subscriptions, webhooks, Stripe Checkout, invoices, charges, refunds, trials, coupons, metered billing, and payment failure handling.
343 GitHub starsUsed in 1 repo~1.2k tokens
Backend & APIsAuto-check passed
Spa Auth Development
gdarko/laravel-vue-starter
Activate when working on SPA authentication flow, Sanctum cookie-based auth, Vue Router guards, auth store, login/register/password reset pages, or CORS/session configuration.
145 GitHub stars~668 tokensUpdated 6 mo ago
Backend & APIsAuto-check: notes
Php Laravel Audit
0xShe/PHP-Code-Audit-Skill
Laravel 框架特效安全审计工具。针对 Laravel 常见鉴权/CSRF/Session/模型填充/Blade 渲染等框架特性进行白盒静态审计，并将风险映射到你现有通用漏洞类型体系（AUTH/CSRF/LOGIC/XSS/CFG 等）。
402 GitHub starsUsed in 1 repo~821 tokens
Backend & APIsAuto-check passed
Laravel Security
HoangNguyen0403/agent-skills-standard
Harden Laravel apps with Policies for model authorization, Gate-based RBAC, validated mass assignment, and CSRF protection.
572 GitHub stars~887 tokensUpdated yesterday
Backend & APIsAuto-check passed
Php Framework Audit
wgpsec/AboutSecurity
PHP 框架特定安全审计。当在 PHP 白盒审计中已识别目标使用特定框架、需要检查框架特有安全机制和常见配置缺陷时触发。
1.8k GitHub stars~767 tokensUpdated yesterday
Backend & APIsAuto-check: notes
Psalm Security Analysis
cachethq/core
Runs and interprets Psalm security (taint) analysis on a Laravel project.
230 GitHub stars~4.7k tokensUpdated 6 days ago
SecurityAuto-check passed

Questions about Laravel Security

What does Laravel Security do?

Buenas prácticas de seguridad en Laravel para autenticación/autorización, validación, CSRF, asignación masiva, subida de archivos, secretos, limitación de velocidad y despliegue seguro. Laravel Security is an agent skill from affaan-m/ECC. Buenas prácticas de seguridad en Laravel para autenticación/autorización, validación, CSRF, asignación masiva, subida de archivos, secretos, limitación de velocidad y despliegue seguro.

When should I use Laravel Security?

Laravel Security fits situations like: tasks that involve Backend development; tasks that involve Web application vulnerabilities.

How do I install Laravel Security in Claude Code?

Run `npx skills add affaan-m/ECC --skill laravel-security -a claude-code`. Or copy the skill folder (docs/es/skills/laravel-security in affaan-m/ECC) into .claude/skills/laravel-security in your project. Claude Code loads it when a task matches its description.

How do I install Laravel Security in Codex?

Run `npx skills add affaan-m/ECC --skill laravel-security -a codex`. Or copy the skill folder (docs/es/skills/laravel-security in affaan-m/ECC) into .agents/skills/laravel-security in your project. Codex loads it when a task matches its description.

Can I use Laravel Security in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add affaan-m/ECC --skill laravel-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/laravel-security, .gemini/skills/laravel-security, .github/skills/laravel-security and .opencode/skills/laravel-security in your project.

What does Laravel Security need to run?

Going by SKILL.md and its folder, Laravel Security needs the command-line tools its instructions call (composer) and credentials named APP_KEY. Our summary lists: A credential in APP_KEY.

Does Laravel Security access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Laravel Security safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Laravel Security use?

Laravel Security is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Laravel Security use?

About 2.1k tokens (SKILL.md is roughly 8.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Laravel Security?

Skills that share tags, products or a category with Laravel Security: Cashier Stripe Development (luadotsh/lua, 343 stars), Spa Auth Development (gdarko/laravel-vue-starter, 145 stars), Php Laravel Audit (0xShe/PHP-Code-Audit-Skill, 402 stars) and Laravel Security (HoangNguyen0403/agent-skills-standard, 572 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Laravel Security?

affaan-m (a GitHub user) maintains it in affaan-m/ECC, which has 276,111 GitHub stars. The repository holds 683 skills in this directory. The repository was last updated on October 10, 2026.

Source: affaan-m/ECC on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Laravel Security

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Buenas Prácticas de Seguridad en Laravel

Cuándo Activar

Cómo Funciona

Configuración Principal de Seguridad

Reforzamiento de Sesión y Cookies

Autenticación y Tokens

Seguridad de Contraseñas

Autorización: Policies y Gates

Validación y Sanitización de Datos

Protección contra Asignación Masiva

Prevención de Inyección SQL

Prevención de XSS

Protección CSRF

Seguridad en Subida de Archivos

Limitación de Velocidad

Secretos y Credenciales

Atributos Encriptados

Cabeceras de Seguridad

CORS y Exposición de API

Logging y PII

Seguridad de Dependencias

URLs Firmadas

Files

Compare with similar skills

Similar skills

More from affaan-m/ECC

Related

Questions about Laravel Security