Laravel
BackendCommonly used with
Skills using Laravel (101)
php
PHP development: code quality, PSR standards, testing with PHPUnit.
php-quality
PHP code quality: PSR standards, strict types, framework idioms.
php-testing
PHP testing patterns: PHPUnit, test doubles, database testing.
app-builder
App scaffolding: Next.js, Vite, Nuxt, Astro, FastAPI, Django, Laravel, RN, Flutter. Triggers: scaffold, bootstrap, new project, starter, dashboard, mobile app.
explore
Explores codebase structure, stack, and architecture. Triggers: explore codebase, project structure, stack overview, architecture map.
ui-ux-pro-max
UI/UX design intelligence for web and mobile. Searchable local database with 84 styles, 192 color palettes, 74 font pairings, 192 product types, 98 UX guidelines, 104 icon entries, 16 GSAP motion presets, and 25 chart types across 22 stacks (React, Next.js, Vue, Nuxt, Svelte, Astro, SwiftUI, React Native, Flutter, Tailwind, shadcn/ui, Jetpack Compose, Angular, Laravel, JavaFX, WPF, WinUI, Avalonia, Uno Platform, UWP, Three.js, and HTML/CSS). Use when designing, building, or reviewing UI: pages, components, color schemes, typography, layout, accessibility, animation, or data visualization.
apex-methodology
Systematic development workflow: Analyze → Plan → Execute → eLicit → eXamine. Use for ANY development task: features, bug fixes, refactoring, hotfixes. Triggers: "implement", "create", "build", "fix", "add feature", "refactor", "develop". Auto-detects project type (Laravel, Next.js, React, Swift) and loads framework-specific references. Enforces: files <100 lines, interfaces separated, SOLID principles, expert self-review, sniper validation. Modes: --auto (default), --manual, --skip-elicit
exploration
Codebase exploration techniques for rapid discovery, architecture analysis, pattern detection, and dependency mapping.
lazy-agent-loader
Load agent definitions on-demand to reduce context usage. Only loads full agent when needed.
hunt-laravel
Hunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars), Laravel Telescope/Horizon dashboard unauthorized access, Ignition RCE (CVE-2021-3129), Signed URL manipulation, Queue Worker abuse, mass assignment via Eloquent, deserialization via cookies, .env file exposure. Use when target runs Laravel (PHP) — detected via X-Powered-By, Laravel session cookies, or /storage/ paths.
modularize
Use when converting existing code to modular architecture. Detects Laravel (FuseCore or standard) / Next.js / React and applies correct modular patterns. Triggers: "modularize", "convert to modules", "migrate to modular", "restructure modules".
framework-expert
Unified framework expertise bundle. Lazy-loads relevant framework patterns (React, Vue, Angular, Next.js, Node.js, Python, Laravel, Go, Flutter, Godot) based on detected tech stack.
laravel-expert
Laravel/PHP gotchas and decision criteria. Covers N+1 prevention, Eloquent traps, and migration safety.
hunt-dispatch
Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set. Use when /hunt has just received a mode answer (redteam or wapt + blackbox|greybox) and needs to load the appropriate skills and print the taxonomy. Not for direct user invocation.
map-ecosystem
Enrich auto-generated .cartographer/ maps with full descriptions from source files. Use when: cartography index descriptions are truncated, a new plugin/skill was just added, or after SessionStart regenerates the map.
ui-ux-pro-max
UI/UX design intelligence for web and mobile. Includes 50+ styles, 161 color palettes, 73 font pairings, 161 product types, 99 UX guidelines, and 25 chart types across 16 stacks (React, Next.js, Vue, Nuxt.js, Nuxt UI, Svelte, Astro, Angular, Laravel, shadcn/ui, HTML/Tailwind, SwiftUI, Jetpack Compose, React Native, Flutter, and Three.js). Actions: plan, build, create, design, implement, review, fix, improve, optimize, enhance, refactor, and check UI/UX code. Projects: website, landing page, dashboard, admin panel, e-commerce, SaaS, portfolio, blog, and mobile app. Elements: button, modal, navbar, sidebar, card, table, form, and chart. Styles: glassmorphism, claymorphism, minimalism, brutalism, neumorphism, bento grid, dark mode, responsive, skeuomorphism, and flat design. Topics: color systems, accessibility, animation, layout, typography, font pairing, spacing, interaction states, shadow, and gradient. Integrations: shadcn/ui MCP for component search and examples.
craft-project-setup
Scaffold Claude Code configuration specifically for Craft CMS projects. Generates CLAUDE.md and .claude/rules/ files tailored to the project type (plugin, site, module, hybrid, or monorepo). Only for Craft CMS projects — not for Next.js, Laravel, or other frameworks. Triggers on: 'set up Claude for this Craft project', 'initialize CLAUDE.md', 'scaffold project config', 'configure Claude Code for Craft', 'create CLAUDE.md', 'missing CLAUDE.md', 'does this project have a CLAUDE.md', 'bootstrap Claude config', 'new Craft project setup', 'onboard a developer to this Craft project', 'generate .claude/rules', 'set up coding standards config', 'upgrade Claude config', 'update CLAUDE.md', 'compare my setup', 'is my config up to date', 'audit my Claude setup', 'redo project setup'. Also triggers when starting work in a new Craft CMS project that lacks a CLAUDE.md file, or when the user wants to check or upgrade an existing configuration. Detects project type from composer.json (craft-plugin, craft-module, project), .d
go-architecture
Structure Go 1.22+ services — standard cmd/internal layout, constructor-based dependency injection, HTTP routing (net/http ServeMux vs chi vs echo/gin/fiber), and type-safe database access with sqlc + pgx. Use when laying out a new Go project, choosing a router or DB layer, or wiring dependencies. Do NOT use for goroutines/channels patterns (go-concurrency) or language idioms (go-core-idioms).
sales-bagisto
Bagisto platform help — open-source (MIT) Laravel/PHP eCommerce framework for developers and makers: products, orders, carts, customers, and checkout via a REST API and a GraphQL API (Shop + Admin), plus multi-vendor marketplace, POS, B2B, and multi-channel/headless storefronts, self-hosted or on Bagisto Cloud. Use when building a Bagisto REST or GraphQL integration, authenticating requests (Laravel Sanctum bearer token, X-STOREFRONT-KEY storefront key, or JWT for the headless package), creating a guest cart token, pulling products/orders into a CRM or warehouse, fixing a broken install or slow page loads, fixing broken images after an APP_URL change, choosing self-host vs Bagisto Cloud, or comparing Bagisto to Medusa/Saleor/Shopify. Do NOT use for cross-cart checkout-conversion strategy (use /sales-checkout) or picking a Merchant of Record for global tax (use /sales-merchant-of-record).
govard-laravel
Laravel-specific Govard shortcuts and commands. Use when: - "Run migrations", "artisan commands" - "Clear Laravel cache", "config:cache" - "Queue operations", "schedule:run" - "Tinker into app", "artisan tinker" - "Laravel Pint", "npm dev/prod" DEPENDENT on govard-toolbox for base commands.
analysis-autonomous-mode
ONLY when user explicitly requests autonomous analysis, deep investigation, multi-step research, or 'dig into this end-to-end without asking me each step' — NOT for normal feature work.
analysis-skill-router
Use when picking which analysis or project-analysis-* skill fits a request — routes by scope, framework, and symptom — even if the user just says 'analyze this' or 'dig into the codebase'.
api-endpoint
Use when creating an API endpoint or HTTP route handler — detects the project stack and routes to the matching carve-out (laravel-api-endpoint, nextjs-patterns, symfony-workflow).
artisan-commands
Use when creating or modifying Artisan commands. Covers clear signatures, safe execution flow, helpful output, and project conventions for console tooling.
authz-review
Use when reviewing authorization end-to-end — route → gate → policy → query scope → response filter — before changes to permissions, tenants, ownership, or admin flows.
blade-ui
Use when the project's frontend stack is Blade — dispatched by `directives/ui/{apply,review,polish}.ts`. Covers views, components, partials, layouts, and view logic.
code-refactoring
Use when the user says 'refactor this', 'rename class', or 'move method'. Safely refactors code in any language — finds all callers, updates downstream dependencies, verifies via quality tools.
command-routing
Use when the user invokes a slash command like /create-pr, /commit, /fix-ci, or pastes command file content — routes to the right command with context inference and GitHub API patterns.
composer-packages
Use when building or maintaining a Composer library — versioning, Laravel integration, autoloading, publishing to private registries — even when the user says 'release a new version'.
vibe-ship
Generates a complete, production-ready deployment setup for any app in one pass -- Dockerfile, docker-compose.yml, .dockerignore, CI/CD (GitHub Actions), scalability config (health checks, resource limits, K8s on request), and security hardening (non-root user, secrets, dependency scanning). Auto-detects the stack from repo files (package.json, requirements.txt, go.mod, pom.xml, Gemfile, etc.) and writes real working files, not just advice. Also audits an EXISTING Dockerfile/compose/CI setup with a static scoring script and reports concrete findings. Use whenever the user asks to "dockerize", "containerize", "make this deployable", "production-ready", "vibe ship this", "add CI/CD", "set up deployment", "ship this app", requests a Dockerfile/docker-compose/GitHub Actions workflow, or wants a deployment setup reviewed -- even for just one piece (e.g. "add a Dockerfile"), since the full set is interdependent.
laravel-specialist
Use when building Laravel 10+ applications requiring Eloquent ORM, API resources, or queue systems. Invoke for Laravel models, Livewire components, Sanctum authentication, Horizon queues.
php-pro
Use when building PHP applications with modern PHP 8.3+ features, Laravel, or Symfony frameworks. Invoke for strict typing, PHPStan level 9, async patterns with Swoole, PSR standards.
vibe-security
Security intelligence for code analysis. Detects SQL injection, XSS, CSRF, authentication issues, crypto failures, and more. Actions: scan, analyze, fix, audit, check, review, secure, validate, sanitize, protect. Languages: JavaScript, TypeScript, Python, PHP, Java, Go, Ruby. Frameworks: Express, Django, Flask, Laravel, Spring, Rails. Vulnerabilities: SQL injection, XSS, CSRF, authentication bypass, authorization issues, command injection, path traversal, insecure deserialization, weak crypto, sensitive data exposure. Topics: input validation, output encoding, parameterized queries, password hashing, session management, CORS, CSP, security headers, rate limiting, dependency scanning.
gitlab-project-bootstrap
Set up or audit GitLab project metadata hygiene (avatar, description, topics, badges, README) for Cinetic Digital's private client repos on gitlab.com. Use this whenever the user is starting a brand-new client project, asks to "configure" or "bootstrap" a GitLab project, wants project descriptions/tags/topics/badges set, mentions a project's README is missing/stock/hidden/needs improving, or asks what's missing / what should be set up on a GitLab repo. Also trigger when the user mentions a specific client project by name (e.g. a PrestaShop or Laravel repo) and asks about its GitLab page, its description, or wants it to "look proper." Works both for brand-new projects (apply everything from minute 1) and for auditing/fixing an existing one.
gitlab-security-setup
Sets up a full security stack on your company's projects hosted on GitLab.com (non-PrestaShop: Laravel, Astro, TanStack, etc.). Use ONLY when the project is a GitLab.com Free tier project. Triggers when the user asks to add dependency scanning, vulnerability alerts, security setup, Trivy, pnpm supply chain protection, or wants email reports of vulnerabilities. Do NOT use for GitHub-hosted projects, personal projects, or PrestaShop projects — use ps-security-audit skill instead for any PrestaShop project.
release
Bump a plugin's version, write a detailed changelog entry for the upgrade skill to consume, and commit+push. Takes a plugin slug argument identifying which plugin under `plugins/` to release. Use this skill whenever the user says "release", "version bump", "cut a release", "changelog and push", or finishes a set of changes and wants to ship them. Also trigger when the user says "do the release thing" or asks to prepare changes for hermits to pick up.
govard-toolbox
High-level shortcuts and references for Govard development environment orchestrator. Use when: - "Start/stop environment", "govard up", "govard down" - "Run commands in container", "govard sh" - "Database operations", "db dump", "db import" - "Sync with remote", "bootstrap from staging" - "Debug configuration", "Xdebug setup" This is the BASE skill - for framework-specific shortcuts, also load govard-magento or govard-laravel.
stacks
Stack-specific skills organized by technology category (backend, frontend, infrastructure, mobile)
langfuse-laravel-ai
Use when adding Langfuse tracing/observability to a Laravel app that uses the laravel/ai SDK (Laravel\Ai\ namespace, Agent classes, ->prompt()/->stream(), tools, conversations). Activate when the user wants to trace LLM/agent calls, token usage, or tool invocations to Langfuse in a Laravel project, pairs Langfuse with laravel/ai, or asks why traces aren't showing up. Laravel/PHP-specific: laravel/ai has no OpenTelemetry support and there is no first-party PHP Langfuse SDK, so the integration path is non-obvious.
php-api-scaffolder
Scaffolds Laravel API endpoints with API Resource responses, Form Request validation, Sanctum authentication, throttle-based rate limiting, URI versioning, OpenAPI documentation, and health checks. PHP analog of fastapi-scaffolder, minimal-api-scaffolder, and axum-scaffolder. Use when creating REST APIs in Laravel, adding API endpoints, setting up API routing and middleware, or configuring API infrastructure.
php-architecture-checklist
Grades an existing PHP/Laravel codebase. Detects PHP version, framework (Laravel/Symfony/plain), and autoloading layout, then checks service-layer boundaries, strict typing, input validation, query safety, and config/secrets hygiene with file:line evidence. Use to review or grade a PHP codebase. Not for Socratic critique (architecture-review), security audits (php-security-review), or new test-first code (tdd).
php-feature-slice
Scaffolds feature-based PHP / Laravel architecture using feature folders, thin controllers, Form Requests, a service/action layer, and API Resources. PHP analog of dotnet-vertical-slice and python-feature-slice — no mediator library; uses the Laravel service container for dependency injection and structural CQRS conventions. Use when creating feature-based PHP projects, adding Laravel features, scaffolding service layers, or organizing PHP code by feature rather than by technical layer.
php-migration-manager
Manages the full Laravel database migration lifecycle with safety checks and rollback planning (PHP analog of ef-/alembic-/sqlx-migration-manager). Covers create, review, apply, and rollback; enforces a reversible down(), expand-contract for zero-downtime changes, and guards against destructive operations in production. Use when creating or reviewing Laravel migrations, planning a schema change, applying/rolling back, or designing a zero-downtime migration.
php-security-review
OWASP-based security review of PHP / Laravel applications. Detects the framework and entry points, scans against the OWASP Top 10 (2025) mapped to PHP/Laravel patterns (mass-assignment, query injection, Blade XSS, auth/session, file uploads, secrets), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit PHP code for vulnerabilities. Do NOT use to grade architecture/structure — use php-architecture-checklist.
laravel-11-12-app-guidelines
Guidelines and workflow for working on Laravel 11 or Laravel 12 applications across common stacks (API-only or full-stack), including optional Docker Compose/Sail, Inertia + React, Livewire, Vue, Blade, Tailwind v4, Fortify, Wayfinder, PHPUnit, Pint, and Laravel Boost MCP tools. Use when implementing features, fixing bugs, or making UI/backend changes while following project-specific instructions (AGENTS.md, docs/).
laravel-specialist
Build and configure Laravel 10+ applications, including creating Eloquent models and relationships, implementing Sanctum authentication, configuring Horizon queues, designing RESTful APIs with API resources, and building reactive interfaces with Livewire. Use when creating Laravel models, setting up queue workers, implementing Sanctum auth flows, building Livewire components, optimising Eloquent queries, or writing Pest/PHPUnit tests for Laravel features.
pest-testing
Use this skill for Pest PHP testing in Laravel projects only. Trigger whenever any test is being written, edited, fixed, or refactored — including fixing tests that broke after a code change, adding assertions, converting PHPUnit to Pest, adding datasets, and TDD workflows. Always activate when the user asks how to write something in Pest, mentions test files or directories (tests/Feature, tests/Unit) or architecture tests. Covers: it()/expect() syntax, datasets, mocking, browser testing, arch(), Livewire component tests, RefreshDatabase, and all Pest 4 features. Do not use for editing factories, seeders, migrations, controllers, models, or non-test PHP code.
clean-architecture
Clean Architecture reference, reduced to this owner's positions and test-based enforcement. Use when scaffolding, reviewing layers, or designing a layered system.
laravel-skills
Laravel framework patterns, best practices, and implementation guides
sota-php
State-of-the-art PHP engineering (2026 baseline, PHP 8.3+ floor, 8.5 current) for both writing new PHP and auditing existing PHP code. Covers strict_types and modern idioms (enums, readonly, match, fibers, property hooks), OWASP-grade security (SQL injection, XSS, file uploads, LFI/RFI, unserialize/Phar object injection, sessions, password hashing, sodium, SSRF), framework-neutral web hardening, Composer supply chain and static analysis (PHPStan/Psalm levels, baselines), and runtime performance (OPcache, preloading, FPM tuning, JIT, N+1). Use whenever the task involves PHP source, composer.json, php.ini, FPM config, or a PHP framework — building features, scaffolding projects, reviewing PRs, or hunting bugs and vulnerabilities. Trigger keywords: PHP, composer, Laravel, Symfony, WordPress, PHPStan, Psalm, PHPUnit, Pest, PDO, php-fpm, OPcache, strict_types, phar, unserialize, htmlspecialchars.
laravel-best-practices
Apply this skill whenever writing, reviewing, or refactoring Laravel PHP code. This includes creating or modifying controllers, models, migrations, form requests, policies, jobs, scheduled commands, service classes, and Eloquent queries. Triggers for N+1 and query performance issues, caching strategies, authorization and security patterns, validation, error handling, queue and job configuration, route definitions, and architectural decisions. Also use for Laravel code reviews and refactoring existing Laravel code to follow best practices. Covers any task involving Laravel backend PHP code patterns.
pest-testing
Use this skill for Pest PHP testing in Laravel projects only. Trigger whenever any test is being written, edited, fixed, or refactored — including fixing tests that broke after a code change, adding assertions, converting PHPUnit to Pest, adding datasets, and TDD workflows. Always activate when the user asks how to write something in Pest, mentions test files or directories (tests/Feature, tests/Unit, tests/Browser), or needs browser testing, smoke testing multiple pages for JS errors, or architecture tests. Covers: test()/it()/expect() syntax, datasets, mocking, browser testing (visit/click/fill), smoke testing, arch(), Livewire component tests, RefreshDatabase, and all Pest 4 features. Do not use for factories, seeders, migrations, controllers, models, or non-test PHP code.
deploy
Deploys your app to DigitalOcean or AWS — generates Nginx config, SSL, systemd service, and step-by-step server setup for Ubuntu/CentOS
php
PHP development — OOP patterns, Laravel basics, WordPress plugin development, REST API endpoints, wpdb queries, security (sanitization, nonces)
api-to-openapi
将自然语言接口描述、接口文档、参数表格或支持的后端代码转换为标准 OpenAPI 3.0.3 JSON， 并在需要时生成 Postman Collection 等平台兼容产物，供 Postman / Apifox / ApiPost 导入后形成可调试接口。 Use when the user asks to generate, export, convert, or validate Swagger/OpenAPI/importable API documentation from existing API descriptions, docs, tables, or code. Do not use merely to implement, call, debug, or review API code. Directly writing/importing into external platforms is outside this skill and belongs to a separate MCP such as api-publish.
eloquent-best-practices
Best practices for Laravel Eloquent ORM including query optimization, relationship management, and avoiding common pitfalls like N+1 queries.
security-audit-light
Perform a PR-scoped security audit on a small to medium code change (1-20 files, additive endpoint, schema change, refactor). Produces a structured findings table with confidence scores, no false positives, and a clean verdict. Trigger only when the user explicitly asks for a "security audit", "security review", "vulnerability check", "is this safe to ship", or "OWASP check" of recent changes. NOT for greenfield threat modeling, full-codebase reviews, or infrastructure audits — those need heavier tooling. NOT for proactive scanning while writing code.
skill-orchestration
Skill router — activates at the start of any non-trivial task to match the task to the right domain skills and MCP tools before acting. Trigger proactively on every task, or when unsure which skills apply. Provides a decision matrix mapping task signals to skills and MCP routes. Reduces missed skill activations and ensures MCP tools are used where they add value.
api-contract-init
Generate API_CONTRACT.md by scanning existing routes and controllers
write-code
Use when writing, editing, or reviewing code in any language or framework.
laravel-plugin-discovery
Use when finding or evaluating Laravel packages (maintenance health, Laravel/PHP version compatibility, vendor reputation) via the free LaraPlugins.io MCP server. Covers the MCP endpoint config and the exact SearchPluginTool / GetPluginDetailsTool parameter schemas and filter values.
bifrost-gateway
Routes EVERY LLM / AI-provider request through a Bifrost (OpenAI-compatible) gateway so that all calls are logged and tracked in one place. Use this skill WHENEVER you write, configure, or debug any code that calls a large language model or AI provider — OpenAI/GPT, Anthropic/Claude, Google Gemini, DeepSeek, xAI/Grok, Perplexity, or any other — in ANY language (Python, PHP, JavaScript/TypeScript, Go, curl) or framework (Laravel AI SDK, LangChain, LlamaIndex, Vercel AI SDK). This covers new integrations, editing existing client setup, base_url / api_key configuration, chat completions, the Responses API, embeddings, and streaming. Trigger even when the user only says "call gpt-4o", "add Claude to this script", "sk-bf-...", "generate text with an LLM", or names a provider SDK without mentioning the gateway. NEVER call provider APIs directly — the whole point of the gateway is that no request goes around it.
ui-pro-forge
UI/UX design intelligence for web and mobile. Searchable local database with 85 styles, 193 color palettes, 74 font pairings, 192 product types, 98 UX guidelines, 104 icon entries, 16 GSAP motion presets, and 25 chart types across 21 stacks (React, Next.js, Vue, Nuxt, Svelte, SolidJS, Astro, SwiftUI, React Native, Flutter, Tailwind, shadcn/ui, Jetpack Compose, Angular, Laravel, JavaFX, WinUI, Avalonia, Uno Platform, Three.js, and HTML/CSS). Use when designing, building, or reviewing UI: pages, components, color schemes, typography, layout, accessibility, animation, or data visualization.
herd-worktree
Set up an isolated git worktree for a Laravel project served by Laravel Herd (Pro-aware). Composes vd:worktree for the worktree/.env/port mechanics, then adds the Herd layer: link + scheme-correct site (HTTPS via herd secure when the source is secured), .env rewrite (APP_URL, SESSION_DOMAIN, Sanctum - only when present), opt-in per-worktree database isolation, Vite TLS/CORS, then hands finishing to vd:ship / vd:git. Triggers: 'herd-worktree', 'herd worktree', 'laravel herd worktree', 'isolate a Laravel feature branch', 'work on this Laravel branch with Herd'.
calendar
Calendar canvas for displaying events and picking meeting times. Use when showing calendar views or when users need to select available time slots.
canvas
**The primary skill for terminal TUI components.** Covers spawning, controlling, and interacting with terminal canvases. Use when displaying calendars, documents, or flight bookings.
document
Document canvas for displaying and editing markdown content. Use when showing documents, emails, or when users need to select text for editing.
flight
Flight canvas for comparing flights and selecting seats. Use when users need to browse flight options and book seats.
senior-project-manager
Converts specs to tasks and remembers previous projects. Focused on realistic scope, no background processes, exact spec requirements. Use when the user asks about senior project manager, needs this workflow, or requests related deliverables.
openapi-audit
Audit and repair a project's whole OpenAPI/Swagger spec — inventory every API route, find endpoints that are undocumented or documented partially, and fill the gaps from real code. Use for pre-existing spec debt (a project whose Swagger is empty or stale), not for the endpoints of the task you are currently implementing.
tailwind-spacing-audit
This skill should be used when the user mentions uneven spacing, alignment issues, inconsistent gaps between elements, mixed margin/gap strategies, navbar or toolbar spacing problems, or asks to "clean up", "normalize", or "audit" spacing in a Tailwind component. This skill also applies when reviewing UI code where flex/grid containers use a mix of gap-*, margin (m*, me-*, ms-*), padding, and fixed widths to space sibling elements — even if the user doesn't explicitly say "spacing." If someone pastes a nav bar, toolbar, header, or action bar and says "something looks off," this skill is almost certainly what they need.
integration-development
Guides API contract audits and alignment between frontend and backend services. Use when checking endpoints, payloads, or CORS.
php-pro
Use when building, debugging, refactoring, testing, or reviewing PHP code in Laravel, Symfony, generic modern PHP, or legacy PHP 5.6 + Yii 1.1 codebases. Detect the active runtime first, then load only the matching reference set; for Laravel, confirm the resolved major version and load the version-specific reference before touching bootstrap/app.php, middleware, exceptions, auth, testing infrastructure, or Laravel-coupled packages. Not for frontend-only or non-PHP tasks. Output: runtime-matched implementation or review guidance with compatibility and verification gates.
attack-report
security-scan結果をMarkdownレポートに変換。脆弱性をCVSSスコア降順でソートし、Executive Summary・推奨事項を含むレポートを生成。「レポート生成」「attack report」「脆弱性レポート」「スキャン結果をまとめて」で起動。Do NOT use for スキャン実行（→ security-scan）やスキャン+レポート一括実行（→ security-audit）。
deep-discovery
Deep, multi-agent blast-radius discovery — fan out impact-mapper across every seed in parallel, dedup into one map, verify dynamic edges. Use ONLY for L3/L4 changes touching many seeds, by explicit invocation; drives a Workflow (~15× tokens). Escalates start-task discovery.
deep-grounding
Deep, multi-agent grounding of an external API — fan out cited readers across the docs, build a capability matrix, then an adversarial panel verifies every row. Use ONLY for L3/L4 integrations, by explicit invocation; it drives a Workflow (~15× tokens). Escalates ground-integration.
deep-review
Deep, multi-agent risk review — find risks across every dimension, then adversarially verify each finding before reporting. Use ONLY for L3/L4 diffs, by explicit invocation; drives a Workflow (~15× tokens). Escalates risk-review.
grill
A relentless interview that stress-tests a plan, decision, or idea until nothing is left silently assumed.
ground-integration
Ground an external/third-party API integration before coding — fetch official docs, build a capability matrix, mark unknowns, and require sandbox proof. Use whenever a task touches an external service, SDK, webhook, or a payment/booking/messaging provider.
client-doc
Write a client-facing document for a non-technical client — the outcome, what is in and out of scope, an AI-hours estimate, and what is needed from them. English canonical file plus a Russian mirror under docs/client/. Not a substitute for an implementation spec.
final-check
Run the final AI-SDD self-review before handing off backend work — run format, static analysis, and targeted tests, verify the Definition of Done, and produce the handoff summary.
frontend-handoff
Produce the frontend-developer handoff docs in ai/frontend after a backend feature or change is fully implemented and the gates are green. Writes a Russian instruction doc — what to build, when, how, why, where, plus the API contract (no frontend code) — updates the affected reference docs, then offers to commit. Use as the closing step of any implementation that changes the frontend-facing surface (endpoints, response shape, validation, auth, states, visibility).
implement-approved
Implement an already-approved spec/plan for a Laravel backend through existing architecture boundaries. Use only after the user has explicitly approved the plan or spec in the current conversation.
init
Onboard a repository to the Groundwork workflow — generate thin domain-only AGENTS.md/CLAUDE.md by grounded discovery, install Laravel Boost, and drop .groundwork.json. Use once per project; re-run to refresh from current code.
spec
Create or update an implementation spec under docs/specs/ for a backend feature, bug fix, API/contract change, migration, or risky domain change. Use after discovery, before implementation.
start-task
Start a backend task through the Groundwork AI-SDD discovery/plan workflow. Use at the beginning of any non-trivial feature, bug fix, or API/schema/permission/workflow/integration change, before writing code.
laravel-development
Guides Laravel backend development including routing, controllers, migrations, Eloquent ORM optimization, and form validation. Use when writing Laravel code.
codebase-to-mermaid
This skill should be used when the user asks to "map this codebase", "draw a diagram of this repo", "generate a flow diagram", "make a mermaid diagram", "visualize this project", "show how this code flows", "what does this repo do", "diagram the architecture", "render a flowchart of this app", "sequence diagram of this endpoint", "class diagram of these models", "onboarding diagram", "produce a flow.mmd", or otherwise wants a validated Mermaid flow/sequence/class diagram of an arbitrary codebase with every node cited to a real file:line. Auto-detects archetype (HTTP service, CLI, data pipeline, SPA, Next.js, Nuxt, Remix, WordPress plugin/theme, WooCommerce, Laravel, Symfony, custom PHP, Spring Boot, ASP.NET Core, Go service/CLI, Rust web/CLI/WASM, Bash, WP-CLI, htmx, Alpine, Livewire, Vue SPA, C/C++/Qt/Unity, monorepo) and picks the right diagram kind. Writes raw Mermaid to flow*.mmd. Refuses to invent modules or decorative edges. Does NOT review, refactor, or audit code - diagrams only.
unslop
This skill should be used when the user asks to "deslop", "unslop", "clean AI comments", "remove AI tells", "strip em-dashes", "rewrite AI-generated comments", "make code sound human", "remove leverage/robust/seamless", "kill AI slop", "audit a file for AI tells", or otherwise wants to clean AI-style prose out of source files without changing code behavior. Applies a rule-based pass to comments, docstrings, identifiers, log messages, and error messages across 19+ languages and major frameworks (React, Vue, Next, Nuxt, Astro, Express, Vite, Webpack, Tailwind, WordPress, Laravel, Symfony, Twig, EJS, Alpine, etc.). Edits prose only - does NOT change code behavior, fix bugs, or touch CLI help text, commit messages, or CHANGELOG/LICENSE files.
hotwire
Deep reference for the Hotwire stack from the official handbooks — Turbo (Drive, Frames, Streams, morphing page refreshes), Stimulus (controllers, actions, targets, values, outlets), and Hotwire Native (wrap a web app into iOS and Android apps with bridge components and path configuration). Use this skill whenever the user works with Turbo or Stimulus in any backend (Rails, Laravel, Django, Phoenix, plain HTML), mentions turbo-rails, stimulus-rails, @hotwired packages, turbo_frame_tag, turbo_stream, broadcasts, data-controller/data-action/data-*-target attributes, morphing, "SPA-like without a SPA", partial page updates, live updates over WebSockets — or wants a mobile app from their web app: Hotwire Native, Turbo Native, Strada, bridge components, path configuration, WKWebView/ webview wrapper apps, or "turn my Rails app into an iOS/Android app". Pair with the rails-8 skill for Rails integration specifics.
bootstrap-icons
This skill should be used when the user asks about Bootstrap Icons, Bootstrap icon library, how to install Bootstrap Icons, how to use Bootstrap Icons, Bootstrap icon fonts, Bootstrap icon SVGs, Bootstrap icon sprites, Bootstrap Icons CDN, Bootstrap Icons npm, Bootstrap Icons Composer, PHP Bootstrap Icons, Laravel icons, external image icons, img tag icons, CSS background icons, CSS mask icons, how to style Bootstrap icons, Bootstrap icon sizing, Bootstrap icon colors, Bootstrap icon accessibility, or needs help using icons in Bootstrap projects.
codex-multi-agent
マルチエージェントでタスク分解・委譲・並列実行・結果統合を行うための共通運用スキル。Use when: 「マルチエージェントで進めたい」「並列で進めたい」「サブエージェントに任せたい」「複数 agent で調査/実装/レビューしたい」。Codex / Claude Code のどちらでも使える共通原則を定義し、末尾にツール別の読み替えを置く。
set-stack
ตั้งค่า tech stack สำหรับ project ด้วยการเลือก preset หรือกำหนดเอง เขียนลง .claude/config/tech-stack.md ให้ implement/ship/debug ใช้ commands ถูกต้องอัตโนมัติ ใช้ skill นี้เมื่อเริ่มต้น project หรือเปลี่ยน stack เช่น "ตั้ง stack", "ใช้ Next.js + PostgreSQL"
setup
เริ่มต้น project ใหม่ด้วยการ scaffold โครงสร้าง .claude/ และ context/ ทั้งหมด พร้อม CLAUDE.md, rules, config, task tracking และ workflow skills ครบชุด ใช้ skill นี้เมื่อเริ่ม project ใหม่ เช่น "setup project", "เริ่ม project ใหม่", "สร้าง structure ให้หน่อย"
frontend-server-rendered
Conventions for server-rendered frontends — a server template renders the page shell, with a client-side framework layered in as islands/widgets rather than a full SPA. Covers Razor (.NET/Optimizely) and Blade (Laravel). Next.js/RSC is not covered here — crew's mode vocabulary treats Next.js as headless (see frontend-nextjs) even though it server-renders. Load when the repo's frontend mode is "server-rendered".
database
ออกแบบ Database Schema สำหรับ PostgreSQL และ Laravel แบบ code-first สร้าง schema, relationships, business rules และ migration-ready guidance ใช้ skill นี้ทันทีเมื่อผู้ใช้พูดถึง database schema, table design, Entity-Relationship, Laravel migration, PostgreSQL model เช่น "ออกแบบ table ให้หน่อย", "ช่วยทำ ER diagram", "เขียน migration สำหรับระบบนี้" แม้จะไม่ได้ขอ Masterplan โดยตรง ให้ trigger skill นี้เสมอ ใช้ต่อจาก /architect และเป็นขั้นตอนสุดท้ายของ workflow
laravel-eloquent
Eloquent productivo en Laravel: relaciones, eager loading para evitar N+1, casts y accessors modernos, scopes, recorridos eficientes de datasets grandes y búsqueda vectorial con pgvector. Usar al escribir o revisar modelos, queries o migraciones de Eloquent.
laravel-mcp
Laravel para agentes y MCP: instala Laravel Boost (MCP de desarrollo), construye servidores MCP con laravel/mcp, usa el AI SDK first-party (laravel/ai) y expone la app a clientes de IA de forma segura. Usar cuando el proyecto es Laravel y hay que integrar IA, MCP o introspección por agentes.
laravel-pest
TDD con Pest 3 en Laravel: estructura tests/Feature y tests/Unit, RefreshDatabase, factories y states, datasets, expectations, HTTP tests, fakes, time travel y coverage con umbral mínimo. Usar al escribir o correr tests en un proyecto Laravel.
laravel-security
Seguridad de aplicaciones Laravel: auth, autorización, validación, mass assignment, CSRF, rate limiting, inyección SQL, XSS, secrets, uploads y deploy seguro. Usar al crear o revisar endpoints, modelos, formularios o configuración que toque datos de usuario, autenticación o producción.
Showing top 100 of 101 skills using Laravel by quality score.
See all 101 skills via search →Integration detected automatically from skill content. Some results may be false positives.