laravel-security

Laravel security best practices — authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and secure deployment configurations. Use when reviewing Laravel auth, Eloquent safety, CSRF, XSS, API security, or deployment configuration.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, highly actionable Laravel security reference with executable code across auth, authorization, Eloquent, CSRF, XSS, API, uploads, and deployment. Its main weakness is monolithic inline structure with no progressive disclosure splitting the reference material into separate files.

Suggestions

Split large reference sections (e.g., API security, file uploads, deployment configuration) into separate files under references/ and link to them from a leaner SKILL.md overview.

De-duplicate the .env/APP_KEY guidance that recurs in the Production Configuration, Environment File Security, and Secrets sections to tighten the token budget.

Add an explicit validate-fix-retry feedback loop for destructive or batch operations (e.g., deployment hardening, mass-assignment refactors) to raise workflow clarity.

Dimension	Reasoning	Score
Conciseness	Mostly efficient, code-centric content with tight annotations like 'CRITICAL: prevents session fixation' and 'NEVER use $guarded = []'; not a 5 because the .env warning is repeated across sections and the Quick Security Checklist partially recapitulates the inline guidance.	4 / 5
Actionability	Fully executable, copy-paste-ready PHP throughout — config arrays, middleware, policies, FormRequest rules, and custom Rule classes — covering the common Laravel security cases.	5 / 5
Workflow Clarity	Boot-time validation checkpoints ('throw new RuntimeException(\"APP_KEY is not set...\")', required-key loop) and a Quick Security Checklist provide verification; not a 5 because the skill is topical rather than a single sequenced workflow with explicit validate-fix-retry feedback loops.	4 / 5
Progressive Disclosure	Good section headers but ~940 lines of inline reference with no bundle files and no one-level-deep external references; content like API security, deployment, and the checklist could live in separate reference files. Not a 2 because internal section structure is clear.	3 / 5
	Total	16 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A well-constructed description that explicitly states both the capability scope and the trigger conditions in third person, with concrete Laravel-specific security terms. Minor gains are possible by adding synonyms (roles, permissions, Sanctum) and reframing domain areas as concrete actions.

Suggestions

Add natural synonyms to the trigger clause such as 'roles and permissions', 'Sanctum/Passport tokens', or 'mass assignment' to broaden keyword coverage.

Consider framing the 'what' as concrete actions (e.g., 'Reviews and hardens Laravel auth, Eloquent, CSRF, and XSS defenses') rather than listing capability nouns.

Dimension	Reasoning	Score
Specificity	Lists several concrete security domains — 'authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and secure deployment configurations' — with the action 'reviewing' in the trigger clause; not a 5 because these are mostly capability areas rather than concrete actions like 'extract' or 'merge'.	4 / 5
Completeness	Explicitly answers both what ('Laravel security best practices — authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and secure deployment configurations') and when ('Use when reviewing Laravel auth, Eloquent safety, CSRF, XSS, API security, or deployment configuration') with concrete trigger phrases.	5 / 5
Trigger Term Quality	The 'Use when reviewing Laravel auth, Eloquent safety, CSRF, XSS, API security, or deployment configuration' clause covers natural terms developers say; not a 5 because synonyms like 'permissions', 'roles', 'Sanctum', or 'Passport' are absent from the trigger.	4 / 5
Distinctiveness Conflict Risk	Clear niche — Laravel-specific security with distinct triggers (auth, Eloquent safety, CSRF, XSS, deployment) — minimal conflict risk with general backend or framework skills.	5 / 5
	Total	18 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (949 lines); consider splitting into references/ and linking	Warning
metadata_version	'metadata.version' is missing	Warning

	Total	14 / 16 Passed

Repository: affaan-m/ECC
Path: skills/laravel-security/SKILL.md
Commit: 06c5e11

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.