The Agent Skills Directory

[SAFE]: The skill provides extensive documentation on security best practices for Laravel, including specific instructions to prevent SQL injection (using parameter binding), XSS (using proper Blade escaping syntax), and mass assignment (using fillable/guarded properties). It also correctly advises on the use of encrypted database casts for sensitive information like API tokens.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and refactor user-provided Laravel code, which creates a potential surface for indirect prompt injection if the target codebase contains adversarial instructions.
Ingestion points: User-provided Laravel source files (controllers, models, migrations) as scoped in SKILL.md.
Boundary markers: None defined within the skill body.
Capability inventory: The skill assumes the agent can read/write files and execute framework commands (php artisan).
Sanitization: None provided; the skill itself is intended to be the logic for generating safe code.
[COMMAND_EXECUTION]: The skill refers to standard development and security tools in its documentation, such as php artisan and composer audit. These references are used for educational purposes to teach developers how to audit their own projects and are not executed silently or maliciously by the skill itself.

laravel-best-practices