Laravel
BackendCommonly used with
Skills using Laravel (445)
hunt-laravel
Hunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars), Laravel Telescope/Horizon dashboard unauthorized access, Ignition RCE (CVE-2021-3129), Signed URL manipulation, Queue Worker abuse, mass assignment via Eloquent, deserialization via cookies, .env file exposure. Use when target runs Laravel (PHP) — detected via X-Powered-By, Laravel session cookies, or /storage/ paths.
php
PHP development: code quality, PSR standards, testing with PHPUnit.
php-quality
PHP code quality: PSR standards, strict types, framework idioms.
php-testing
PHP testing patterns: PHPUnit, test doubles, database testing.
app-builder
App scaffolding: Next.js, Vite, Nuxt, Astro, FastAPI, Django, Laravel, RN, Flutter. Triggers: scaffold, bootstrap, new project, starter, dashboard, mobile app.
explore
Explores codebase structure, stack, and architecture. Triggers: explore codebase, project structure, stack overview, architecture map.
laravel-specialist
Build and configure Laravel 10+ applications, including creating Eloquent models and relationships, implementing Sanctum authentication, configuring Horizon queues, designing RESTful APIs with API resources, and building reactive interfaces with Livewire. Use when creating Laravel models, setting up queue workers, implementing Sanctum auth flows, building Livewire components, optimising Eloquent queries, or writing Pest/PHPUnit tests for Laravel features.
php-pro
Use when building PHP applications with modern PHP 8.3+ features, Laravel, or Symfony frameworks. Invokes strict typing, PHPStan level 9, async patterns with Swoole, and PSR standards. Creates controllers, configures middleware, generates migrations, writes PHPUnit/Pest tests, defines typed DTOs and value objects, sets up dependency injection, and scaffolds REST/GraphQL APIs. Use when working with Eloquent, Doctrine, Composer, Psalm, ReactPHP, or any PHP API development.
offensive-deserialization
Insecure deserialization exploitation across Java, PHP, .NET, Python, Node.js, and Ruby. Covers gadget chain construction with ysoserial/phpggc/ysoserial.net, ObjectInputStream and BinaryFormatter sink identification, pickle __reduce__ RCE, phar:// wrapper abuse, Jackson polymorphic typing, Json.NET TypeNameHandling, ViewState tampering, node-serialize IIFE injection, Ruby Marshal.load and YAML.load gadgets, framework-specific chains for Spring/Hibernate/Laravel/Symfony, modern attack surfaces including Kubernetes admission webhooks and message queue consumers, WAF bypass through encoding layers and content-type manipulation, and serialVersionUID/JMX/RMI vectors. Activate when the engagement involves deserialization sinks, serialized data in cookies or request bodies, gadget chain development, magic method abuse, ysoserial payload generation, or any review of marshalling and unmarshalling logic in target applications.
ui-ux-pro-max
UI/UX design intelligence for web and mobile. Searchable local database with 84 styles, 192 color palettes, 74 font pairings, 192 product types, 98 UX guidelines, 104 icon entries, 16 GSAP motion presets, and 25 chart types across 22 stacks (React, Next.js, Vue, Nuxt, Svelte, Astro, SwiftUI, React Native, Flutter, Tailwind, shadcn/ui, Jetpack Compose, Angular, Laravel, JavaFX, WPF, WinUI, Avalonia, Uno Platform, UWP, Three.js, and HTML/CSS). Use when designing, building, or reviewing UI: pages, components, color schemes, typography, layout, accessibility, animation, or data visualization.
ui-ux-pro-max
UI/UX design intelligence. Searchable local database with 67 styles, 161 palettes, 57 font pairings, 25 charts, and 21 stacks (React, Next.js, Vue, Svelte, Astro, SwiftUI, React Native, Flutter, WPF, WinUI 3, UWP, Avalonia, Uno Platform, Nuxt, Nuxt UI, Tailwind, shadcn/ui, Jetpack Compose, Three.js, Angular, Laravel). Use when designing, building, or reviewing UI: pages, components, color schemes, typography, layout, accessibility, animation, or data visualization.
apex-methodology
Use when starting ANY development task -- feature, bug fix, refactor, hotfix (triggers: implement, create, build, fix, add feature, refactor, develop).
modularize
Use when converting existing code to modular architecture (Laravel, Next.js, React). Triggers: "modularize", "convert to modules", "migrate to modular", "restructure modules".
php-laravel
Modern PHP 8.4 and Laravel patterns: architecture, Eloquent, migrations, queues, testing. Use when working with Laravel, Eloquent, Blade, artisan, or building/testing a framework-based PHP app. Not for php-src internals, standalone PHP libraries, or general PHP language discussion.
ia-php-laravel
Modern PHP 8.4 and Laravel patterns: architecture, Eloquent, migrations, queues, testing. Use when working with Laravel, Eloquent, Blade, artisan, or building/testing a framework-based PHP app. Not for php-src internals, standalone PHP libraries, or general PHP language discussion.
lazy-agent-loader
Load agent definitions on-demand to reduce context usage. Only loads full agent when needed.
laravel-expert
Laravel & PHP Development Instructions for GitHub Copilot
php-laravel-codestyle
Custom Instructions: PHP 8+ & Laravel Architecture Expert
nuxt-ui
Use when building styled UI with @nuxt/ui v4 components — forms, data tables, modals, theming. Use vue for raw patterns, reka-ui for headless.
mesh-awareness
Discover agents across local node and mesh peers at runtime — their roles, handles, and how to communicate with or delegate to them.
agent-readiness
Scores how ready a repository is for AI coding agents to work in it effectively, then remediates the gaps - grades agent instruction files, verifiable feedback loops, onboarding reproducibility, and codebase navigability against a fixed 30-signal rubric, stack-agnostic across TypeScript, Python, Go, Rust, Ruby, Java, C#, and PHP/Laravel. Activates when the user says 'is this repo agent-ready', 'readiness report', 'readiness score', 'agent readiness', 'audit this repo for AI agents', 'why do agents struggle in this codebase', 'make this repo agent-friendly', 'audit our agent instruction files', or 'score our agent readiness'. Owns the scoring and the remediation plan; defers the writing of ./docs content to vd:docs, locating code to vd:scout, public documentation sites to vd:docs site, refactoring a change toward its intended architecture to vd:simplify --aggressive, and authoring instruction files and skills to vd:skill-creator.
govard-laravel
This skill should be used when the user asks to "run migrations", "run artisan commands", "clear Laravel cache", "config:cache", "run queue operations", "schedule:run", "tinker into app", "artisan tinker", "run Laravel Pint", or "npm dev/prod". Provides Laravel-specific Govard shortcuts and commands. DEPENDENT on govard-toolbox for base commands.
govard-magento
This skill should be used when the user asks to "clear Magento cache", "flush redis cache", "run Magento CLI", "run bin/magento commands", "deploy static content", "setup:di:compile", "reindex catalog", "run indexer commands", "enable/disable modules", "start frontend sync", "run browser-sync", "set up live reload for Hyva/Luma", or "govard frontend". Provides Magento-specific Govard shortcuts and commands. DEPENDENT on govard-toolbox for base commands.
magento2-backend-dev
This skill should be used when the user asks to "create an API endpoint", "build a REST API", "add a GraphQL resolver", "create a CLI command", "add a cron job", "set up a message queue", "implement a web API", "add a SOAP service", or "create a data provider". Covers Magento 2 backend development: REST/SOAP/GraphQL APIs, CLI commands, and cron jobs. DEPENDENT on magento2-dev-core for security and architecture patterns.
magento2-code-review
This skill should be used when the user asks to "review this PR/MR", "review this merge request", "review this module", "audit this module before merge", "review this theme", "audit this theme PR", or wants a "full review before release". Orchestrates a PR/MR, module, theme, or full-project code review by running the QA trio (magento2-linter, magento2-security-scan, magento2-performance-audit) and magento2-dev-core's anti-pattern checks at the right scope, then merges their findings into one report using a shared severity scale and stable finding codes. DEPENDENT on magento2-dev-core; invokes magento2-linter, magento2-security-scan, and magento2-performance-audit as needed for the chosen scope.
magento2-frontend-dev
This skill should be used when the user asks to "create a Knockout.js component", "add a UI Component", "modify layout XML", "customize a template", "write LESS CSS", "style with the Magento UI library", "add a RequireJS module", "extend JavaScript", "customize checkout", or "modify the cart page". Covers Magento 2 frontend development using the Luma/Blank theme. DEPENDENT on magento2-dev-core for backend patterns and escaping.
magento2-hyva-dev
This skill should be used when the user asks to "create a Hyvä theme", "set up a child theme", "build an Alpine.js component", "make this CSP-compliant", "add Tailwind CSS classes", "convert Luma to Hyvä", "migrate Knockout to Alpine", work on "Hyvä checkout" or "Hyvä React components", or handle "Tailwind configuration" or "CSP nonce registration". Provides expert Hyvä theme development for Magento 2. This is a SPECIALIZED skill for Hyvä-specific patterns. DEPENDENT on magento2-dev-core for PHP/backend patterns.
magento2-linter
This skill should be used when the user asks to "check coding standards", "run phpcs", "lint my code", "run PHPStan analysis", "run static analysis on this module", "find security issues in code", "check code complexity", "find code smells", "detect unused code", "audit custom code", or "verify code quality before commit". Runs automated code quality checks for Magento 2 projects — PHPCS (Magento2 standard), PHPStan, and PHPMD. DEPENDENT on magento2-dev-core for understanding the coding standards it validates.
magento2-performance-audit
This skill should be used when the user asks to "audit performance", "check Core Web Vitals", "run Lighthouse", "check server configuration", "verify Redis/Varnish setup", "analyze database queries", "find N+1 query issues", "review indexer configuration", "check cron health", "debug cache flush", asks "why does full_page cache keep flushing", wants to "trace FPC invalidation", or reports "too many ajax requests", a "customer data section reload storm", or a "crawler overloading server". Performs a comprehensive performance and health audit for Magento 2 projects against Adobe Commerce Best Practices. DEPENDENT on magento2-dev-core for code-level performance patterns.
magento2-security-scan
This skill should be used when the user asks to "run a security audit", "find vulnerabilities", "check for XSS", "check CSRF protection", "validate form security", "run a dependency audit", "check for outdated packages", "run a PCI compliance check", or "do a security review before deploy". Scans Magento 2 code for security vulnerabilities and compliance issues. DEPENDENT on magento2-dev-core for security patterns.
craft-project-setup
Scaffold Claude Code configuration specifically for Craft CMS projects. Generates CLAUDE.md and .claude/rules/ files tailored to the project type (plugin, site, module, hybrid, or monorepo). Only for Craft CMS projects — not for Next.js, Laravel, or other frameworks. Triggers on: 'set up Claude for this Craft project', 'initialize CLAUDE.md', 'scaffold project config', 'configure Claude Code for Craft', 'create CLAUDE.md', 'missing CLAUDE.md', 'does this project have a CLAUDE.md', 'bootstrap Claude config', 'new Craft project setup', 'onboard a developer to this Craft project', 'generate .claude/rules', 'set up coding standards config', 'upgrade Claude config', 'update CLAUDE.md', 'compare my setup', 'is my config up to date', 'audit my Claude setup', 'redo project setup'. Also triggers when starting work in a new Craft CMS project that lacks a CLAUDE.md file, or when the user wants to check or upgrade an existing configuration. Detects project type from composer.json (craft-plugin, craft-module, project), .d
framework-expert
Unified framework expertise bundle. Lazy-loads relevant framework patterns (React, Vue, Angular, Next.js, Node.js, Python, Laravel, Go, Flutter, Godot) based on detected tech stack.
laravel-expert
Laravel/PHP gotchas and decision criteria. Covers N+1 prevention, Eloquent traps, and migration safety.
analysis-autonomous-mode
Autonomous multi-step investigation — deep research carried end-to-end without per-step approval; explicit request only, never for normal feature work.
analysis-skill-router
Use when picking which analysis or project-analysis-* skill fits a request — routes by scope, framework, and symptom — even if the user just says 'analyze this' or 'dig into the codebase'.
api-endpoint
Use when creating an API endpoint or HTTP route handler — detects the project stack and routes to the matching carve-out (laravel-api-endpoint, nextjs-patterns, symfony-workflow).
artisan-commands
Use when creating or modifying Artisan commands. Covers clear signatures, safe execution flow, helpful output, and project conventions for console tooling.
authz-review
Use when reviewing authorization end-to-end — route → gate → policy → query scope → response filter — before changes to permissions, tenants, ownership, or admin flows.
blade-ui
Use when the project's frontend stack is Blade — dispatched by `directives/ui/{apply,review,polish}.ts`. Covers views, components, partials, layouts, and view logic.
code-refactoring
When the user says 'refactor this', 'rename class', or 'move method'. Safely refactors code in any language — finds all callers, updates downstream dependencies, verifies via quality tools.
command-routing
Use when the user invokes a slash command like /create-pr, /commit, /fix-ci, or pastes command file content — routes to the right command with context inference and GitHub API patterns.
composer-packages
Use when building or maintaining a Composer library — versioning, Laravel integration, autoloading, publishing to private registries — even when the user says 'release a new version'.
map-ecosystem
Use when cartography index descriptions are truncated, a new plugin/skill was just added, or after SessionStart regenerates the map.
release
Bump a plugin's version, write a detailed changelog entry for the upgrade skill to consume, and commit+push. Takes a plugin slug argument identifying which plugin under `plugins/` to release. Use this skill whenever the user says "release", "version bump", "cut a release", "changelog and push", or finishes a set of changes and wants to ship them. Also trigger when the user says "do the release thing" or asks to prepare changes for hermits to pick up.
testing-laravel
Writes Laravel tests using PHPUnit. Use when "write tests", "add tests", "phpunit", "laravel test", "feature test", "unit test", "mock", "factory", or testing controllers, models, services, actions, jobs, artisan commands, or API endpoints.
php-laravel
Modern PHP 8.2+ and Laravel patterns: architecture, Eloquent, queues, Pest testing. Use when asked to "write PHP", "build a Laravel app", "fix Eloquent query", "add a queue job", "write a Pest test", or mentions PHP, Laravel, Eloquent, Blade, artisan, or migrations.
ui-ux-pro-max
UI/UX design intelligence for web and mobile. Includes 50+ styles, 161 color palettes, 73 font pairings, 161 product types, 99 UX guidelines, and 25 chart types across 16 stacks (React, Next.js, Vue, Nuxt.js, Nuxt UI, Svelte, Astro, Angular, Laravel, shadcn/ui, HTML/Tailwind, SwiftUI, Jetpack Compose, React Native, Flutter, and Three.js). Actions: plan, build, create, design, implement, review, fix, improve, optimize, enhance, refactor, and check UI/UX code. Projects: website, landing page, dashboard, admin panel, e-commerce, SaaS, portfolio, blog, and mobile app. Elements: button, modal, navbar, sidebar, card, table, form, and chart. Styles: glassmorphism, claymorphism, minimalism, brutalism, neumorphism, bento grid, dark mode, responsive, skeuomorphism, and flat design. Topics: color systems, accessibility, animation, layout, typography, font pairing, spacing, interaction states, shadow, and gradient. Integrations: shadcn/ui MCP for component search and examples.
mir-backend-php
Make It Right (PHP runtime tier). Zend Engine / PHP 8.4–8.5 runtime reliability footguns that are shared across EVERY PHP backend framework (Laravel, Symfony, WordPress, Slim, Lumen) — distinct from the generic backend gates and from any one framework's mechanics. Covers: shared-nothing request lifecycle under PHP-FPM and why static/global state does not persist, concurrency = pm.max_children (not threads), long-running worker runtimes (FrankenPHP, Swoole, RoadRunner, Laravel Octane) and the state-bleed/memory-leak inversion they introduce, max_execution_time not counting blocked I/O, memory_limit, opcache plus the PHP 8.4 opcache.jit default flip, persistent PDO connection state, SIGTERM handling in queue workers, PHP's error/exception model in production, and runtime-level security settings (register_argc_argv, session.use_strict_mode, unserialize, parse_url/SSRF, Composer supply chain). TRIGGER when the backend runtime is PHP and the concern is the engine, the php.ini, or the process model — sits between m
mir-backend-php-laravel
Make It Right (Laravel module). Laravel 13 / 12 + Eloquent ORM + MySQL/PostgreSQL + Redis + Laravel Queues + Octane + the Laravel AI SDK — mechanical reliability augmentation. Use alongside mir-backend and mir-backend-php when the target stack is Laravel; it carries the footguns the framework-agnostic tiers deliberately omit: Eloquent N+1 and automatic eager loading, mass assignment via $fillable/$guarded and the forceFill bypass, queued vs. inline work with the Laravel 13 job attributes, DB::transaction() boundaries and afterCommit semantics, migrations that are NOT transactional on MySQL, Octane container/request/config injection bleed, and prompt injection plus tool authorization in the Laravel AI SDK. TRIGGER only when the PHP backend stack is Laravel — building, reviewing, or debugging a Laravel controller, Eloquent model, Job, migration, policy, middleware, or AI agent/tool. Always loads TOGETHER WITH mir-backend (the gates) and mir-backend-php (Zend Engine runtime concerns: shared-nothing lifecycle, FP
fortrabbit
Use this skill when managing, deploying, or troubleshooting a web app or website hosted on fortrabbit. Covers git push deployments, deploy hook triggers, remote SSH commands (artisan, craft console, wp-cli), database pull/push via SSH tunnel, file and content sync via rsync, and environment onboarding. Supports Laravel, Craft CMS, Kirby, Statamic, WordPress, and generic PHP. Also use when the user mentions SSH key setup, a fortrabbit dashboard action, or a frbit.app hostname — even if they don't say "fortrabbit" explicitly.
fortrabbit-api-access
Use when connecting an agent, MCP client, or script to fortrabbit — installing the fortrabbit MCP server (`mcp.fortrabbit.com/mcp`), calling the `/v1` REST API, or resolving `401` / "Authentication required" / "Invalid access token" errors. Prefers the browser-based OAuth install (no credential handling) and falls back to a dashboard-issued `frbit-at-` Public API token for REST, CI, and clients without OAuth support. Also use when the MCP server has no tool for an operation: the `frbit` CLI and the `/v1` REST API reach further than MCP, so a missing tool is not a missing capability. Trigger on mentions of "connect fortrabbit", "install the fortrabbit MCP server", "fortrabbit token", "API token", "frbit-at-", "Bearer", "MCP", "/v1", "dash.fortrabbit.com", "frbit CLI", "no MCP tool for", "MCP cannot", or "not exposed over MCP".
go-architecture
Use when laying out a new Go service, choosing an HTTP router or DB layer, or wiring dependencies. Not for concurrency (go-concurrency) or language idioms (go-core-idioms).
herd-worktree
Set up an isolated git worktree for a Laravel project served by Laravel Herd (Pro-aware). Composes vd:worktree for the worktree/.env/port mechanics, then adds the Herd layer: link + scheme-correct site (HTTPS via herd secure when the source is secured), .env rewrite (APP_URL, SESSION_DOMAIN, Sanctum - only when present), opt-in per-worktree database isolation, Vite TLS/CORS, then hands finishing to vd:ship / vd:git. Triggers: 'herd-worktree', 'herd worktree', 'laravel herd worktree', 'isolate a Laravel feature branch', 'work on this Laravel branch with Herd'.
vibe-security
Security intelligence for code analysis. Detects SQL injection, XSS, CSRF, authentication issues, crypto failures, and more. Actions: scan, analyze, fix, audit, check, review, secure, validate, sanitize, protect. Languages: JavaScript, TypeScript, Python, PHP, Java, Go, Ruby. Frameworks: Express, Django, Flask, Laravel, Spring, Rails. Vulnerabilities: SQL injection, XSS, CSRF, authentication bypass, authorization issues, command injection, path traversal, insecure deserialization, weak crypto, sensitive data exposure. Topics: input validation, output encoding, parameterized queries, password hashing, session management, CORS, CSP, security headers, rate limiting, dependency scanning.
govard-toolbox
This skill should be used when the user asks to "start/stop environment", "govard up", "govard down", "run commands in container", "govard sh", "do database operations", "db dump", "db import", "sync with remote", "bootstrap from staging", "debug configuration", or "set up Xdebug". Provides high-level shortcuts and references for the Govard development environment orchestrator. This is the BASE skill — for framework-specific shortcuts, also load govard-magento or govard-laravel.
magento2-dev-core
This skill should be used when the user is creating new Magento 2 modules or customizations, implementing features following Magento architecture, working with Dependency Injection, Repositories, or Plugins, writing secure Magento code, or building backend logic, CLI commands, or cron jobs. Foundation skill for professional Magento 2 development. This is the CORE skill that other Magento 2 skills depend on. Always load this first.
openui-forge-php
OpenUI generative UI with a PHP (Laravel 13.x) backend. Forwards OpenAI's SSE stream verbatim via response()->stream().
analyze-problem
Use when structured problem analysis for debugging, root cause identification, and breaking down complex issues before proposing solutions
api-review
Use when reviewing HTTP API design in a PR or change set — endpoints, routes, HTTP methods, status codes, idempotency, and input validation. Treats the API as a consumer-facing contract and flags resource-orientation, method-semantics, status-code, and trust-boundary violations. Read-only.
article-writing
Use when writing articles, guides, blog posts, tutorials, newsletter issues, or other long-form content longer than a paragraph, especially when voice consistency, structure, and credibility matter. Produces polished prose in a distinctive voice derived from supplied examples or a default operator voice.
assignment-compliance-check
Use when checking that the pull request implementation actually fulfills the business requirements stated in the linked issue or task. Returns a plain-language markdown block that is the Functional review half of the two-part CR output (`@rules/code-review/general.mdc` Two-part CR output — Technical & Functional review): a full checklist of every extracted acceptance criterion with its status (Met / Not met / Partial / Divergent) and an explicit Goal met: Yes/No verdict, rendered on every run that has a linked tracker — including the fully affirmative report when every requirement is satisfied. No local file is created and the block is not embedded in the GitHub PR comment.
automation-audit-ops
Use when you need an evidence-first, read-only inventory of every automation in this repo (GitHub Actions, Claude Code hooks/settings, MCP servers, composer scripts, the bundled CLI installer, the skills catalog, scheduler/cron) before changing any of them, classifying each as live, broken, or redundant and recommending keep/merge/cut/fix.
autonomous-loops
Use when choosing how to run Claude Code autonomously on this project — from a single sequential pipeline to multi-agent DAG orchestration. A reference catalog of loop patterns anchored to this repo's real tooling (resolve-issue, autoresolve-oldest-github-issue, code-review-github, process-code-review, merge-github-pr, /loop), with composer build / composer skill-check as the quality gate between iterations.
autoresolve-oldest-github-issue
Use when autonomously resolving the oldest open GitHub issue end-to-end. Picks the oldest open issue (optionally filtered by label, default `Resolve_by_AI`), delegates resolution to `resolve-issue`, then runs `code-review-github`, `process-code-review`, and `merge-github-pr` on the resulting pull request. Stops and reports any blocker (merge conflict, failing CI, unresolved Critical/Moderate findings) instead of force-merging.
benchmark
Use when measuring performance baselines or detecting regressions before and after a change in a Laravel app — page Core Web Vitals, API latency percentiles, build/test velocity, and DB query timing, stored as git-tracked baselines for team comparison.
benchmark-optimization-loop
Use when a goal is vague speed ("make it faster", "reduce p95", "cut query time") and you need a bounded, measured loop that promotes only verified, correctness-preserving wins instead of guessed micro-tweaks.
blueprint
Use when a single objective is too large for one pull request and must span multiple sessions or PRs. Turns the objective into a sequenced construction plan of 3-12 one-PR steps, each with a cold-start context brief, dependency edges, and exit criteria, then reviews it adversarially and registers it as Markdown.
class-refactoring
Use when refactor PHP classes to improve structure, readability, and maintainability while preserving behavior
cleanup-local-branches
Use when cleaning up local Git branches after origin pruning. Deletes local branches whose upstream was deleted on origin (marked gone) and local branches with no origin counterpart that have been inactive for more than six months, while always protecting the current branch and the default branches. Previews every deletion before running it.
code-review-bugsnag
Use when run code review for a Bugsnag error and publish results to the linked GitHub PR and the Bugsnag error
code-review-github
Use when perform code review for GitHub pull requests and post findings as PR comments plus a non-technical summary to every linked issue
code-review-jira
Use when run code review for JIRA issues and publish results to GitHub PR and JIRA
create-issues-from-text
Use when break down assignment into multiple structured issues
create-missing-tests-in-pr
Reads your pull request code review, verifies that all recommended test coverage is implemented in the codebase, and adds missing tests using the create-test skill. Use when a PR review already exists and missing tests must be completed with 100% coverage for current changes.
create-test
Use when create or update tests to ensure full coverage for current changes
design-system
Use when generating, auditing, or reviewing the visual design system of a Laravel app — Tailwind tokens, Filament theming, Blade/Livewire component consistency, and visual-polish audits.
docker-patterns
Use when writing or reviewing Docker and docker-compose setups for a Laravel application — multi-stage PHP-FPM images, services (nginx, MySQL, Redis, queue worker, scheduler, Vite build), healthchecks, secrets, and image hardening.
e2e-testing
Use when writing or stabilizing Playwright end-to-end browser tests against a Laravel app — but only when the project already has Playwright; otherwise defer to manual testing or Pest/Dusk.
frontend-a11y
Use when building or reviewing accessible UI in a Laravel app — semantic Blade markup, accessible forms, keyboard navigation with Alpine, focus and live-region management for Livewire updates, contrast, and Filament accessibility.
frontend-design-direction
Use when the work is not just making UI function but making it feel purposeful and polished — choosing a deliberate design direction for a Laravel/Blade/Livewire/Filament interface.
frontend-patterns
Use when building Livewire/Blade/Alpine UI in a Laravel app — component composition, state placement, performance, forms, and loading/empty/error states.
frontend-slides
Use when building standalone HTML/CSS/JS presentation slide decks — self-contained single-file decks with viewport-fit layout, keyboard navigation, and browser Print-to-PDF export.
git-workflow
Use when choosing a Git branching strategy or handling merge vs rebase, conflicts, stashing, undoing mistakes, and release tagging — complementing the commit/PR conventions in the git rules.
laravel-authorization-review
Use when reviewing authorization / access control in a Laravel project — find IDOR / broken object-level authorization (BOLA), audit which routes are unprotected, check policy / gate coverage, or sanity-check a new endpoint in a PR. Walks the authorization chain of every HTTP route (middleware → authorize/policy/gate → query scoping → API Resource output), anchors every finding to real `php artisan route:list --json` output plus a cited `file:line`, classifies by confidence, and produces a per-route coverage map. Read-only / advise-only — never edits code.
laravel-security
Use when building, configuring, or hardening security-sensitive Laravel features — authentication, authorization, Eloquent safety, CSRF/XSS, API security, file uploads, secrets, and production configuration. Provides condensed, copy-ready secure defaults for Laravel 11 / PHP 8.3.
laravel-telescope
Use when analyzing Laravel Telescope requests from URL and DB. Loads Telescope entries, matches the same request in database tables, and proposes practical optimizations.
latency-critical-systems
Use when working on latency-sensitive Laravel paths — realtime dashboards, streaming, queues, caches, or execution gateways — where p95 latency and data freshness matter.
merge-github-pr
Use when safely merge GitHub pull requests that are ready
mysql-patterns
Use when designing MySQL schema features or applying advanced MySQL patterns in Laravel — upserts, JSON columns, full-text search, partitioning, replication/read-write splitting, and deadlock handling — beyond the query tuning already in the SQL rules.
mysql-problem-solver
Use when analyze real MySQL query and schema problems using code inspection, schema review, and EXPLAIN when available
penetration-tester
Use when the user explicitly requests a penetration test (pentest, ethical hacking, active exploitation, red-team assessment) against an authorized in-scope target — and only then. Runs a methodology-driven offensive assessment that validates exploitability with safe proofs of concept and delivers a risk-rated remediation report. Does not run on a normal code-review, security-review, or resolve-issue pass.
postgres-patterns
Use when designing PostgreSQL schema features or applying advanced Postgres patterns in Laravel — GIN/BRIN/partial/covering indexes, jsonb, ON CONFLICT upserts, SKIP LOCKED queue workers, cursor pagination, RLS, and timestamptz/numeric typing — beyond the query tuning already in the SQL rules.
pr-staged-merge-plan
Use when a large pull request should be merged and deployed in safe parts instead of all at once. Analyzes every commit in the PR, groups them into atomic logical units that each ship independently without downtime, orders the units by dependency and rollback risk, proposes squashes for a clean human-readable history, and proposes corrected subjects for vague or inaccurate commit messages. Read-only — it proposes the plan and never rewrites history, pushes, or merges.
pr-summary
Use when summarizing current PR changes for the development and product team. Analyzes all commits in the current branch, explains the purpose of changes, and produces a clear human-readable report that can be posted either as a GitHub PR comment (Markdown) or as a JIRA comment (Wiki Markup).
prepare-issue-context
Use when preparing data and context before /resolve-issue, TDD, or CR runs. Loads the assignment, extracts every concrete user scenario from the task description and acceptance criteria, maps each scenario to the codebase, seeds the development database with the records needed to reproduce the bug or feature end-to-end, and reports any gap that would force the implementing agent to hallucinate.
process-code-review
Use when processing pull request code review feedback. Finds the latest PR for a task, resolves review comments, updates review status, and triggers the next review cycle.
product-capability
Use when a PRD or product intent is clear but the implementation constraints are not — turns a vague capability ask into an engineering-ready plan that exposes invariants, interfaces, and unresolved decisions before any code is written.
readme-generator
Use when a repository needs a maintainer-ready README.md (or sibling root docs like CONTRIBUTING / SECURITY) built from the project's actual code, manifests, scripts, and tests — a zero-hallucination scan that extracts real commands, setup steps, and configuration, with git commit/push only when the user explicitly asks. Adapted from the VoltAgent readme-generator subagent.
record-project-memory
Use when a task has converged (end of resolve-issue, process-code-review, or the final orchestrator report) and a durable, reusable lesson was learned. Distils only the lessons that clear a strict promotion bar and appends them — after a dedup/supersede/prune curation pass — to the per-project compound memory file, never recording trivia, secrets, or PII.
redis-patterns
Use when using Redis in a Laravel app — caching strategies, atomic/distributed locks, rate limiting, stampede protection, pub/sub, pipelines, and key/TTL design beyond raw query tuning.
Showing top 100 of 445 skills using Laravel by quality score.
See all 445 skills via search →Integration detected automatically from skill content. Some results may be false positives.