The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, repository-specific instructions and documentation, which constitutes an ingestion of untrusted data into the agent's context.
Ingestion points: The skill reads repository-level instructions, documentation indexes, and utilizes an external search-docs tool via the Laravel Boost MCP server.
Boundary markers: The instructions do not define specific text delimiters for external content but specify that user requests and repository instructions should override default guidelines.
Capability inventory: The skill allows for file system modifications, execution of Artisan commands, database schema inspection, and arbitrary code execution via Laravel Tinker.
Sanitization: The skill includes defensive programming guidelines, specifically instructing the agent to "never interpolate untrusted SQL" and to use Form Request classes for validation.
[COMMAND_EXECUTION]: The skill facilitates the use of the Laravel Artisan CLI (php artisan) and formatting tools like PHP Pint (vendor/bin/pint). These tools execute commands in the host or Docker environment to perform tasks such as running tests, creating migrations, or installing API support.
[DYNAMIC_EXECUTION]: The skill references the use of Laravel Tinker and other executable-code tools provided by the Boost MCP server. These tools allow for the execution of arbitrary PHP code within the application context. The skill mitigates the risk by explicitly scoping these tools to local or test environments unless the user provides specific authorization for non-local operations.

laravel-11-12-app-guidelines