The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of a third-party Composer package 'grazulex/laravel-devtoolbox' which is not associated with a trusted vendor.
Evidence: composer require --dev grazulex/laravel-devtoolbox in SKILL.md.
[CREDENTIALS_UNSAFE]: The skill contains commands that specifically access and compare sensitive environment files (.env) and tail application logs, both of which frequently contain credentials and PII.
Evidence: php artisan dev:env:diff --against=.env.example and php artisan dev:log:tail.
[DATA_EXFILTRATION]: The skill includes documentation for an integration script that sends local application scan results to an external, non-whitelisted domain.
Evidence: curl -X POST https://monitoring.example.com/metrics -d @/var/metrics/laravel-scan.json in the 'Monitoring Dashboard Integration' section.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by ingesting and processing untrusted codebase metadata which could contain adversarial instructions targeting the agent.
Ingestion points: Reading model relationships, route definitions, and container bindings via artisan scan commands.
Boundary markers: The instructions lack explicit delimitation or warnings to ignore embedded instructions in the analyzed data.
Capability inventory: The skill utilizes shell_exec and file writing capabilities across its usage examples.
Sanitization: No sanitization or validation of the ingested application metadata is mentioned.

laravel-devtoolbox-cli