Laravel Security Audit
aiskillstore/marketplace
Security auditor for Laravel applications. An agent skill from aiskillstore/marketplace.
Runs and interprets Psalm security (taint) analysis on a Laravel project.
Install Psalm Security Analysis
$ npx skills add cachethq/core --skill psalm-security-analysis -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install cachethq/core psalm-security-analysis --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/cachethq/core.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/psalm-security-analysis .claude/skills/psalm-security-analysis && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "psalm-security-analysis" agent skill from https://github.com/cachethq/core/tree/main/.agents/skills/psalm-security-analysis into .claude/skills/psalm-security-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "psalm-security-analysis", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/cachethq/core/tree/main/.agents/skills/psalm-security-analysisType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add cachethq/core --skill psalm-security-analysis -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install cachethq/core psalm-security-analysis --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cachethq/core.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/psalm-security-analysis .agents/skills/psalm-security-analysis && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "psalm-security-analysis" agent skill from https://github.com/cachethq/core/tree/main/.agents/skills/psalm-security-analysis into .agents/skills/psalm-security-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "psalm-security-analysis", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add cachethq/core --skill psalm-security-analysis -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install cachethq/core psalm-security-analysis --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cachethq/core.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/psalm-security-analysis .cursor/skills/psalm-security-analysis && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "psalm-security-analysis" agent skill from https://github.com/cachethq/core/tree/main/.agents/skills/psalm-security-analysis into .cursor/skills/psalm-security-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "psalm-security-analysis", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/cachethq/core.git --path .agents/skills/psalm-security-analysis--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add cachethq/core --skill psalm-security-analysis -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install cachethq/core psalm-security-analysis --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cachethq/core.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/psalm-security-analysis .gemini/skills/psalm-security-analysis && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "psalm-security-analysis" agent skill from https://github.com/cachethq/core/tree/main/.agents/skills/psalm-security-analysis into .gemini/skills/psalm-security-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "psalm-security-analysis", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install cachethq/core psalm-security-analysisInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add cachethq/core --skill psalm-security-analysis -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/cachethq/core.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/psalm-security-analysis .github/skills/psalm-security-analysis && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "psalm-security-analysis" agent skill from https://github.com/cachethq/core/tree/main/.agents/skills/psalm-security-analysis into .github/skills/psalm-security-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "psalm-security-analysis", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add cachethq/core --skill psalm-security-analysis -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install cachethq/core psalm-security-analysis --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cachethq/core.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/psalm-security-analysis .opencode/skills/psalm-security-analysis && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "psalm-security-analysis" agent skill from https://github.com/cachethq/core/tree/main/.agents/skills/psalm-security-analysis into .opencode/skills/psalm-security-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "psalm-security-analysis", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
psalm-security-analysis- GitHub stars
- 230
- Token cost
- ~4.7k tokens
- SKILL.md length
- 1,580 words
- Files
- 1
- Skills in repo
- 3
- Repo updated
- First seen
- Licence
- Custom licence
At a glance
Runs and interprets Psalm security (taint) analysis on a Laravel project.
- Works in 3 steps: Is there a real path from user input to… → Is there any sanitization/validation… → What's the access level? (public…
- The user asks to find security vulnerabilities
- SKILL.md covers Core Package Scope, Running the analysis, Triage and How taint analysis works, plus 6 more sections
- Calls jq and rg
What it does
Psalm Security Analysis is an agent skill from cachethq/core. Runs and interprets Psalm security (taint) analysis on a Laravel project. Use when the user asks to find security vulnerabilities, run a security scan, check for SQL injection or XSS, audit code for taint issues, or fix Psalm taint errors. Also use when investigating data flow from user input to sensitive operations, even if the user doesn't explicitly mention Psalm or taint analysis. Requires psalm-plugin-laravel installed.
Its SKILL.md is about 4.7k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Backend development, Web application vulnerabilities and Static analysis and SAST. It works with Laravel. The repository describes itself as: 🚦 The core for Cachet, an open source, self-hosted status page system.
When your agent uses it
- The user asks to find security vulnerabilities
- Run a security scan
- Check for SQL injection
- Audit code for taint issues
Example prompts
- “/psalm-security-analysis”
Workflow steps
3 steps, taken from the first numbered list in SKILL.md.
- Is there a real path from user input to the sink? (or is the tainted value from a model/service that doesn't actually accept user data?)
- Is there any sanitization/validation between source and sink? (allowlist check, in_array, cast to int, e(), parameterized query?)
- What's the access level? (public endpoint vs admin-only, affects real-world exploitability)
What it can do on your machine
Read from SKILL.md and the folder at commit 57b44a8. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
jqrg
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
github.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Psalm Security Analysis loads about 4.7k tokens when it runs. Until then it costs about 113 tokens; SKILL.md has 1,580 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 1,580 words (~4,697 tokens).
“Determine which mode to use from the user's prompt before running anything:”
- name
- psalm-security-analysis
- metadata.author
- alies-dev
- metadata.version
- 1.1
Files
Just SKILL.md in .agents/skills/psalm-security-analysis of cachethq/core.
Open the folder on GitHubat commit 57b44a8
Compare with similar skills
Psalm Security Analysis next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Psalm Security Analysis this skillcachethq/core | 230 | — | ~4.7k | Automated safety check: Pass | Custom licence | |
| Laravel Security Auditaiskillstore/marketplace | 430 | 4 repos | ~1.1k | Automated safety check: Notes | None | |
| Laravel Verificationaffaan-m/ECC | 274k | 4 repos | ~1.1k | Automated safety check: Notes | MIT | |
| Php SecurityHoangNguyen0403/agent-skills-standard | 570 | — | ~604 | Automated safety check: Pass | MIT | |
| Django Access Reviewgetsentry/skills | 1k | 3 repos | ~2.6k | Automated safety check: Notes | Apache-2.0 | |
| Cyber NeoHainrixz/cyber-neo | 281 | — | ~5.9k | Automated safety check: Warn | MIT |
Similar skills
Laravel Verification
affaan-m/ECC
Verification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness.
Php Security
HoangNguyen0403/agent-skills-standard
PHP-only security standards for database access, password handling, and input validation.
- Official
Django Access Review
getsentry/skills
Django access control and IDOR security review. An agent skill from getsentry/skills.
Cyber Neo
Hainrixz/cyber-neo
Comprehensive cybersecurity analysis for any local project. An agent skill from Hainrixz/cyber-neo.
Security Reviewer
AratKruglik/claude-laravel
A skill your agent uses when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security.
More from cachethq/core
MCP Development
cachethq/core
A skill your agent uses for Cachet's Laravel MCP server. An agent skill from cachethq/core.
Tailwindcss Development
cachethq/core
A skill your agent uses for Cachet Tailwind CSS and UI styling: Blade utility classes, public status-page components, Filament dashboard theme work, responsive layout, dark mode, spacing…
Related
Works with
Categories
Questions about Psalm Security Analysis
What does Psalm Security Analysis do?
Runs and interprets Psalm security (taint) analysis on a Laravel project. Psalm Security Analysis is an agent skill from cachethq/core. Runs and interprets Psalm security (taint) analysis on a Laravel project.
When should I use Psalm Security Analysis?
Psalm Security Analysis fits situations like: the user asks to find security vulnerabilities; run a security scan; check for SQL injection; audit code for taint issues.
How do I install Psalm Security Analysis in Claude Code?
Run `npx skills add cachethq/core --skill psalm-security-analysis -a claude-code`. Or copy the skill folder (.agents/skills/psalm-security-analysis in cachethq/core) into .claude/skills/psalm-security-analysis in your project. Claude Code loads it when a task matches its description.
How do I install Psalm Security Analysis in Codex?
Run `npx skills add cachethq/core --skill psalm-security-analysis -a codex`. Or copy the skill folder (.agents/skills/psalm-security-analysis in cachethq/core) into .agents/skills/psalm-security-analysis in your project. Codex loads it when a task matches its description.
Can I use Psalm Security Analysis in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add cachethq/core --skill psalm-security-analysis -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/psalm-security-analysis, .gemini/skills/psalm-security-analysis, .github/skills/psalm-security-analysis and .opencode/skills/psalm-security-analysis in your project.
What does Psalm Security Analysis need to run?
Going by SKILL.md and its folder, Psalm Security Analysis needs the command-line tools its instructions call (jq and rg).
Does Psalm Security Analysis access the network?
SKILL.md names 1 domain. As links in the text: github.com. This is read from the text; nothing was executed.
Is Psalm Security Analysis safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Psalm Security Analysis use?
Psalm Security Analysis has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.
How many tokens does Psalm Security Analysis use?
About 4.7k tokens (SKILL.md is roughly 19k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Psalm Security Analysis?
Skills that share tags, products or a category with Psalm Security Analysis: Laravel Security Audit (aiskillstore/marketplace, 430 stars), Laravel Verification (affaan-m/ECC, 274k stars), Php Security (HoangNguyen0403/agent-skills-standard, 570 stars) and Django Access Review (getsentry/skills, 1k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Psalm Security Analysis?
cachethq (a GitHub organization) maintains it in cachethq/core, which has 230 GitHub stars. The repository holds 3 skills in this directory. The repository was last updated on October 5, 2026.
Source: cachethq/core on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.