Guide · Agent skill
How to use the Laravel Security Best Practices agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The laravel-security skill is a written Laravel security guide that an AI agent loads so it can answer Laravel security questions and review code against a checklist of common protections. It is aimed at Laravel developers hardening an application before production, and at developers new to Laravel security who want a structured list. After reading this page you will know what the skill does, how to install it, how to ask for it in plain language, and what it does and does not do.
Laravel Security Best Practicesaffaan-m/ECC · MIT Download the skill Quick start
- 1Download the ZIP. Download the laravel-security skill ZIP from this page.
- 2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use, or into your project's .claude/skills/ folder for one project.
- 3Or upload in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 4Confirm you have a Laravel project. Make sure the code you want reviewed is a Laravel project, since the examples depend on Laravel classes and config files.
- 5Ask a security question. Describe the task in plain language, such as reviewing a login flow or an upload endpoint.
- 6Apply and test changes. Make any changes yourself or with the agent, then verify them with your own tests.
What is an agent skill and what does this one do?
An agent skill is a folder of instructions that an AI agent can load when a task matches it. This skill is defined by a single SKILL.md file that contains Laravel security guidance written in Spanish, covering authentication and authorization, input validation, CSRF, mass assignment, file uploads, secrets, rate limiting and secure deployment.
Once installed, the agent uses this guide when you ask about Laravel security or review Laravel code. It covers login and permission checks with policies, validating input with Form Requests, CSRF and XSS defences, safe file uploads, rate limiting on login, encrypted database fields, security headers and CORS settings. It supplies Laravel code examples for these patterns.
- Checks access control with auth:sanctum, $this->authorize and policy middleware
- Validates input with Form Requests before it reaches services
- Covers CSRF, XSS and SQL injection prevention with Blade and parameter binding
- Gives examples for file uploads, RateLimiter::for('login'), encrypted casts and security headers
- Lists production settings such as APP_DEBUG=false and session cookie settings
What the skill does not do
The skill is a written guide only. It does not change your project by itself, and it runs no scripts and makes no network requests. Any change to your code happens only if you or the agent apply it.
It is a general checklist. It cannot prove that an application is secure, so it is not a full security audit. For high-risk systems, get a professional review.
Requirements before you install
You need a Laravel project. The examples in the guide use Sanctum, Form Requests, Policies and Blade, so they fit best in a Laravel codebase that uses those tools. The guide is not meant for non-Laravel frameworks, because its examples depend on Laravel-specific classes and config files.
- A Laravel project
- Familiarity with Sanctum, Form Requests, Policies and Blade is helpful but not strictly required
How to install the laravel-security skill
There are two options. For a personal setup, download the skill ZIP from this page and unzip it into ~/.claude/skills/. To limit the skill to one project, unzip it into that project's .claude/skills/ folder instead.
If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
- Download the ZIP from this page
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into your project's .claude/skills/ folder
- Claude apps: upload under Settings → Capabilities → Skills
How to trigger the skill with natural requests
You do not need a special command. Ask in plain language about a Laravel security topic, such as login, uploads, validation or rate limiting, and the agent can use the guide. The skill is meant for tasks like adding authentication or authorization, handling user input and file uploads, building new API endpoints, managing secrets and hardening production deployments.
Naming the topic and your Laravel setup gets more specific answers.
- Review my login flow for brute-force protection in Laravel
- Check this Form Request and file upload rules against the Laravel security checklist
- How should I protect this API route with Sanctum and a policy?
- What production .env settings should I check before launch?
Example: rate limiting login and protecting a route
The guide shows how to limit login attempts by IP address and by email, and how to protect a route with Sanctum and a policy. Here is the rate limiter example from the guide:
use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\RateLimiter;
RateLimiter::for('login', function (Request $request) {
return [
Limit::perMinute(5)->by($request->ip()),
Limit::perMinute(5)->by(strtolower((string) $request->input('email'))),
];
});Example: validating a file upload safely
The guide's upload example uses a Form Request that checks the user's permission, requires a PDF under 5120 KB, and stores the file on a non-public disk. The guide notes that the disk should be set to a non-public one.
- Validate size, MIME type and extension
- Store uploads outside the public directory when possible
- Scan files for malware if needed
final class UploadInvoiceRequest extends FormRequest
{
public function authorize(): bool
{
return (bool) $this->user()?->can('upload-invoice');
}
public function rules(): array
{
return [
'invoice' => ['required', 'file', 'mimes:pdf', 'max:5120'],
];
}
}Tips for getting the most from the skill
Use the skill as a checklist, not a verdict. Ask the agent to go through your code area by area, such as login, then uploads, then production config, and note which items it cannot confirm from the code you share.
Check the examples against your own Laravel version and configuration before copying them. The guide's production settings include APP_DEBUG=false, a set APP_KEY, secure session cookies and trusted proxies for correct HTTPS detection.
- Ask for one area at a time to get focused findings
- Share the relevant files, such as routes, Form Requests and policies
- Treat the output as a review aid and confirm changes with tests
- Use a professional review for high-risk systems
What people use it for
- Hardening an existing Laravel application before production
- Reviewing API endpoints that use Sanctum authentication and policies
- Checking file upload validation and private storage
- Adding rate limiting to login and password reset flows
- Teaching a developer new to Laravel the basics of security
Frequently asked questions
How do I install the laravel-security skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into your project's .claude/skills/ folder for a single project. In the Claude apps you can also upload it under Settings → Capabilities → Skills.
What do I need to use the laravel-security skill?
You need a Laravel project. The examples use Sanctum, Form Requests, Policies and Blade, so the skill fits Laravel codebases that use those tools. It does not run scripts or use the network.
Is the laravel-security skill free?
The skill is listed under the MIT licence. Check the licence file in the source repository for the full terms.
Does this skill make my Laravel app secure?
No. It is a general checklist of common protections and cannot prove that an application is secure. For high-risk systems, use a professional security review.
Does the skill change my code automatically?
No. It is a written guide only and does not change your project by itself. Any changes happen only when you or the agent apply them.
Can I use this skill for a non-Laravel framework?
It is not suited to that. The examples depend on Laravel-specific classes and config files, so use a guide for your own framework instead.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits Laravel developers who want a structured checklist to review login, permissions, validation, uploads and production settings before launch, and beginners who need a clear starting point. It is not a security audit and does not fit non-Laravel projects, so high-risk systems should get a professional review and other frameworks need a different guide.
Download the skill