The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill mandates the installation of several unverified packages, including laravel/boost, nunomaduro/essentials, and nunomaduro/pao. These packages are not part of the official Laravel framework or verified community projects, despite being presented as mandatory 'official' components for a future 'Laravel 13' version.
[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute post-installation commands from these unverified packages, such as php artisan boost:install and composer setup. This allows for arbitrary code execution from potentially untrusted or malicious sources that could be registered under these names.
[COMMAND_EXECUTION]: The skill executes various system commands for environment inspection, database creation, and repository management. This includes the direct execution of shell commands like mysql, psql, and sqlcmd with user-supplied or environment-derived values.
[CREDENTIALS_UNSAFE]: The database setup instructions include patterns that encourage passing passwords directly to command-line tools (e.g., sqlcmd -P '<password>'). This practice can lead to sensitive credentials being recorded in plaintext within shell history, process listings, or system logs.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data in the form of community starter kit package names (--using=<vendor/package>). While the skill instructs the agent to verify support, it lacks robust sanitization or boundary markers to prevent malicious instructions embedded in package names or repository metadata from influencing agent behavior.

install-laravel