New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Laravel Security

by HoangNguyen0403 in HoangNguyen0403/agent-skills-standard

Harden Laravel apps with Policies for model authorization, Gate-based RBAC, validated mass assignment, and CSRF protection.

MITAuto-check passedBackend & APIs

Install Laravel Security

skills CLI
$ npx skills add HoangNguyen0403/agent-skills-standard --skill laravel-security -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install HoangNguyen0403/agent-skills-standard laravel-security --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/HoangNguyen0403/agent-skills-standard.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/laravel/laravel-security .claude/skills/laravel-security && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
laravel-security
GitHub stars
572
Token cost
~887 tokens
SKILL.md length
338 words
Files
3 (incl. references)
Skills in repo
211
Repo updated
First seen
Licence
MIT

At a glance

Harden Laravel apps with Policies for model authorization, Gate-based RBAC, validated mass assignment, and CSRF protection.

  • Works in 5 steps: Generate policy — php artisan… → Implement policy methods — Return bool… → Authorize in controller — Call… → …
  • Creating authorization policies
  • SKILL.md covers Priority: P0 (CRITICAL), Workflow: Secure Resource, Policy Example and Implementation Guidelines, plus 4 more sections
  • Calls php

What it does

Laravel Security is an agent skill from HoangNguyen0403/agent-skills-standard. Harden Laravel apps with Policies for model authorization, Gate-based RBAC, validated mass assignment, and CSRF protection. Use when creating authorization policies, securing env config access, or preventing mass assignment vulnerabilities.

Its SKILL.md is about 890 tokens, which your agent loads only when the skill is triggered. The skill folder holds 4 other files, including reference files (for example `evals/evals.json` and `references/implementation.md`).

It sits in Backend & APIs, covering Backend development, Authorization and RBAC and Web application vulnerabilities. It works with Laravel and PHP. The repository describes itself as: A collection of Agent Skills Standard and Best Practice for Programming Languages, Frameworks that help our AI Agent follow best practies on frameworks and programming laguages. The licence is MIT.

When your agent uses it

  • Creating authorization policies
  • Securing env config access
  • Preventing mass assignment vulnerabilities

Example prompts

  • “/laravel-security”

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. Generate policy — php artisan make:policy PostPolicy --model=Post.
  2. Implement policy methods — Return bool for view, update, delete actions.
  3. Authorize in controller — Call $this->authorize('update', $post).
  4. Add Gate bypass — Define Gate::before() for admin users in AuthServiceProvider.
  5. Validate inputs — Use Form Request with $request->validated() for Model::create().

What it can do on your machine

Read from SKILL.md and the folder at commit b529c2d. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • php

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Laravel Security loads about 887 tokens when it runs, and up to ~1.1k if it reads all its reference files. Until then it costs about 64 tokens; SKILL.md has 338 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~64
When it runs · the whole SKILL.md, loaded when a task matches
~887
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from HoangNguyen0403/agent-skills-standard at commit b529c2d, republished under its MIT licence (© HoangNguyen0403). 338 words, ~887 tokens.

Download SKILL.mdSave it as .claude/skills/laravel-security/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.
name
laravel-security
description
Harden Laravel apps with Policies for model authorization, Gate-based RBAC, validated mass assignment, and CSRF protection. Use when creating authorization policies, securing env config access, or preventing mass assignment vulnerabilities.

Laravel Security

Priority: P0 (CRITICAL)

Workflow: Secure Resource

  1. Generate policy — php artisan make:policy PostPolicy --model=Post.
  2. Implement policy methods — Return bool for view, update, delete actions.
  3. Authorize in controller — Call $this->authorize('update', $post).
  4. Add Gate bypass — Define Gate::before() for admin users in AuthServiceProvider.
  5. Validate inputs — Use Form Request with $request->validated() for Model::create().

Policy Example

See implementation examples for Policy class with controller authorization.

Implementation Guidelines

Authorization & RBAC
  • Policies: Always use php artisan make:policy PostPolicy --model=Post for model-level authorization.
  • Checkers: Implement update(User $user, Post $post): bool and call $this->authorize('update', $post) in controllers.
  • Gates: Use Gate::define('admin', fn(User $user) => ...) for global permissions. Check with Gate::allows('admin') or Blade @can('admin'). prefer Policies for model-bound checks; use Gates for global permissions.
  • Admin Bypass: Define Gate::before(fn($u) => $u->isAdmin() ? true : null) in AuthServiceProvider.
Configuration & Environment
  • Environment: Only call env() inside config/*.php files. Access via config('app.key') in your application code. Never env() in controllers; use config() instead.
  • Caching: Run php artisan config:cache to validate that env() isn't used where it shouldn't .
Data & Input Security
  • Mass Assignment: Use Form Request with rules() and call $request->validated() for Model::create(). Define $fillable on model; never pass $request->all() to create().
  • CSRF: Ensure @csrf directive in all Blade <form> tags. active on web routes by default; use ->except(['/webhook']) only for trusted third-party callbacks.
  • Role-Based Access: Use Policies with role checks in policy methods; define Gate::before for admin bypass; or use spatie/laravel-permission; never inline $user->role === 'admin'.

Anti-Patterns

  • No env() outside config files: Access via config() helper.
  • No custom auth logic: Use Laravel's built-in auth system.
  • No unvalidated mass assignment: Always call validated().
  • No auth logic in Blade: Pass permissions as data from controller.

References

Configuration boundary

  • Read environment values only in configuration files; application code uses config('app.key'), never env() in controllers.

Canonical response anchors

When this skill applies, preserve the following domain terminology or equivalent concrete examples in the answer when relevant:

  • configuration files,only in configuration,Do not call `env()

  • @can('admin')

  • never env() in controllers,use config() in controllers,not in controllers

  • web routes,web middleware,CSRF middleware

  • Additional task-grounded exact anchors: config('app.key')

© HoangNguyen0403, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 2 other files (references) in skills/laravel/laravel-security of HoangNguyen0403/agent-skills-standard.

  • SKILL.md
  • evals/evals.json
  • references/implementation.md

Open the folder on GitHubat commit b529c2d

Compare with similar skills

Laravel Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Laravel Security compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Laravel Security this skillHoangNguyen0403/agent-skills-standard572—~887Automated safety check: PassMIT
Php Framework Auditwgpsec/AboutSecurity1.8k—~767Automated safety check: NotesNone
Configuring Horizoncoollabsio/coolify63k4 repos~898Automated safety check: PassMIT
Tyrohasinhayder/tyro685—~1.4kAutomated safety check: PassMIT
Spa Auth Developmentgdarko/laravel-vue-starter145—~668Automated safety check: NotesMIT
Laraveldaily Permissions AuditLaravelDaily/AI-Workflows-For-Laravel136—~5.2kAutomated safety check: PassNone

Similar skills

  • Php Framework Audit

    wgpsec/AboutSecurity

    PHP 框架特定安全审计。当在 PHP 白盒审计中已识别目标使用特定框架、 需要检查框架特有安全机制和常见配置缺陷时触发。

    1.8k GitHub stars~767 tokensUpdated yesterday
    Backend & APIsAuto-check: notes

  • Configuring Horizon

    coollabsio/coolify

    A skill your agent uses whenever the user mentions Horizon by name in a Laravel context.

    63k GitHub starsUsed in 4 repos~898 tokens
    Backend & APIsAuto-check passed

  • Tyro

    hasinhayder/tyro

    Framework-maintainer skill for the Tyro Laravel authorization package

    685 GitHub stars~1.4k tokensUpdated 1 mo ago
    Backend & APIsAuto-check passed

  • Spa Auth Development

    gdarko/laravel-vue-starter

    Activate when working on SPA authentication flow, Sanctum cookie-based auth, Vue Router guards, auth store, login/register/password reset pages, or CORS/session configuration.

    145 GitHub stars~668 tokensUpdated 6 mo ago
    Backend & APIsAuto-check: notes

  • Laraveldaily Permissions Audit

    LaravelDaily/AI-Workflows-For-Laravel

    This skill should be used when the user asks to "audit Laravel permissions", "review roles and permissions", "check authorization code", "find permission issues", "permissions review", "audit access…

    136 GitHub stars~5.2k tokensUpdated 5 mo ago
    Backend & APIsAuto-check passed

  • Laravel Security

    affaan-m/ECC

    Laravel security best practices for authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.

    277k GitHub starsUsed in 3 repos~2k tokens
    Backend & APIsAuto-check passed

More from HoangNguyen0403/agent-skills-standard

All 211 skills in this repo

  • Subagent-Driven Development

    HoangNguyen0403/agent-skills-standard

    Runs a multi-task implementation plan by sending each task to a fresh implementer subagent, reviewing it independently, then reviewing the whole branch.

    572 GitHub stars~1.3k tokensUpdated yesterday
    Auto-check passed

  • draw.io Architecture Diagramming

    HoangNguyen0403/agent-skills-standard

    Draws architecture diagrams as editable draw.io files from a JSON spec, with a fixed house style, one C4 level per diagram and evidence-tagged shapes.

    572 GitHub stars~1.3k tokensUpdated yesterday
    Auto-check passed

  • Android Navigation 3 Guide

    HoangNguyen0403/agent-skills-standard

    Implements and migrates to Jetpack Navigation 3 in Compose: NavDisplay, typed route objects, a state-list back stack, deep links, multiple back stacks and dialog scenes.

    572 GitHub stars~687 tokensUpdated yesterday
    Auto-check passed

  • Angular HttpClient Standards

    HoangNguyen0403/agent-skills-standard

    Sets rules for Angular HTTP code: functional interceptors, typed requests, services that own every call, and httpResource for reactive data loading in Angular 17+.

    572 GitHub stars~652 tokensUpdated yesterday
    Auto-check passed

  • Angular Tooling

    HoangNguyen0403/agent-skills-standard

    Angular CLI usage, code generation, build configuration, and bundle optimization.

    572 GitHub stars~743 tokensUpdated yesterday
    Auto-check passed

  • Common Code Review

    HoangNguyen0403/agent-skills-standard

    Conduct high-quality, persona-driven code reviews. An agent skill from HoangNguyen0403/agent-skills-standard.

    572 GitHub stars~772 tokensUpdated yesterday
    Auto-check passed

Works with

Categories

Questions about Laravel Security

What does Laravel Security do?

Harden Laravel apps with Policies for model authorization, Gate-based RBAC, validated mass assignment, and CSRF protection. Laravel Security is an agent skill from HoangNguyen0403/agent-skills-standard. Harden Laravel apps with Policies for model authorization, Gate-based RBAC, validated mass assignment, and CSRF protection.

When should I use Laravel Security?

Laravel Security fits situations like: creating authorization policies; securing env config access; preventing mass assignment vulnerabilities.

How do I install Laravel Security in Claude Code?

Run `npx skills add HoangNguyen0403/agent-skills-standard --skill laravel-security -a claude-code`. Or copy the skill folder (skills/laravel/laravel-security in HoangNguyen0403/agent-skills-standard) into .claude/skills/laravel-security in your project. Claude Code loads it when a task matches its description.

How do I install Laravel Security in Codex?

Run `npx skills add HoangNguyen0403/agent-skills-standard --skill laravel-security -a codex`. Or copy the skill folder (skills/laravel/laravel-security in HoangNguyen0403/agent-skills-standard) into .agents/skills/laravel-security in your project. Codex loads it when a task matches its description.

Can I use Laravel Security in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add HoangNguyen0403/agent-skills-standard --skill laravel-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/laravel-security, .gemini/skills/laravel-security, .github/skills/laravel-security and .opencode/skills/laravel-security in your project.

What does Laravel Security need to run?

Going by SKILL.md and its folder, Laravel Security needs the command-line tools its instructions call (php).

Does Laravel Security access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Laravel Security safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Laravel Security use?

Laravel Security is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Laravel Security use?

About 887 tokens (SKILL.md is roughly 3.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 222 tokens, read only when the agent opens those files.

What are the alternatives to Laravel Security?

Skills that share tags, products or a category with Laravel Security: Php Framework Audit (wgpsec/AboutSecurity, 1.8k stars), Configuring Horizon (coollabsio/coolify, 63k stars), Tyro (hasinhayder/tyro, 685 stars) and Spa Auth Development (gdarko/laravel-vue-starter, 145 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Laravel Security?

HoangNguyen0403 (a GitHub user) maintains it in HoangNguyen0403/agent-skills-standard, which has 572 GitHub stars. The repository holds 211 skills in this directory. The repository was last updated on October 9, 2026.

Source: HoangNguyen0403/agent-skills-standard on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.