Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hmj1026/dhpk --skill dhpk-composer-package-hygienegit clone --depth 1 https://github.com/hmj1026/dhpkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hmj1026/dhpk/dhpk-composer-package-hygiene)<a href="https://agentmods.dev/skills/hmj1026/dhpk/dhpk-composer-package-hygiene"><img src="https://agentmods.dev/badge/skills/hmj1026/dhpk/dhpk-composer-package-hygiene/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hmj1026/dhpk/dhpk-composer-package-hygiene"><img src="https://agentmods.dev/badge/skills/hmj1026/dhpk/dhpk-composer-package-hygiene.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.00743 |
| Opus 5 | $0.00039 | $0.00371 |
| Sonnet 5 | $0.00016 | $0.00149 |
| Haiku 4.5 | $0.00008 | $0.00074 |
Grade A, and why
dhpk-composer-package-hygiene scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Composer package hygiene
Use this skill for PHP packages installed by downstream projects. Treat every public
symbol, composer.json entry, published artifact, tag, and registry release as one
consumer-facing contract.
Working sequence
- Load
references/package-contracts.mdand select the branch that matches the task. - Inspect the package's declared PHP/dependency floors, public symbols, autoload maps, Laravel discovery metadata, and release files before choosing a change.
- Classify compatibility from the contract rules, not from author intent or the current resolver result alone.
- Run the branch-specific checks in the verification gate below and report any unavailable consumer or registry check as blocked rather than green.
Contract branches
- Semver or public API change →
package-contracts.md§Semver and §Public API surface. composer.json, autoload, or dependency change → §composer.json hygiene.- Laravel providers, aliases, or facade discovery → §Laravel package discovery.
- Changelog, tag, or Packagist publication → §Release flow.
When NOT to Use
- Application code that is never published to downstream consumers.
- Language-level idiom selection; use
skills/dhpk-php-modern-pro. - Laravel service-provider, facade, publishing, or Testbench mechanics; use
dhpk-laravel-package-authorordhpk-laravel-testbench-matrix. - A release workflow that does not publish a Composer package.
Output
Return one of:
- a semver verdict (
major,minor, orpatch) with the contract evidence; - an audited
composer.jsoncovering constraints, autoload, plugins, suggestions, and Laravel discovery metadata; or - a release gate showing the CHANGELOG, tag, GitHub release, package matrix, and registry state.
Verification
- The relevant section of
package-contracts.mdwas loaded before judging. - Every changed public symbol has an intentional
@api/@internalstatus and its dependency types are included in the compatibility decision. -
composer validate --strictpasses. - Lowest supported dependency floors and the declared PHP/framework matrix pass.
- Laravel packages pass
php artisan package:discover --ansiin a fresh consumer install, with a facade smoke test when aliases are present. - A release has a matching versioned CHANGELOG entry, tag, GitHub release, and registry visibility; missing external evidence is reported as blocked.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 68 lines · 78 tokens per session scan A 86e172b4c446
dhpk-composer-package-hygiene is a skill published in the GitHub repository hmj1026/dhpk (2 stars, last pushed today), licensed MIT. It adds 78 tokens to every session and 743 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
php-laravel
Modern PHP 8.2+ and Laravel patterns: architecture, Eloquent, queues, Pest testing. Use when asked to "write PHP", "build a Laravel app", "fix Eloquent query", "add a queue job", "write a Pest test", or mentions PHP, Laravel, Eloquent, Blade, artisan, or migrations.
ia-php-laravel
Modern PHP 8.4 and Laravel patterns: architecture, Eloquent, migrations, queues, testing. Use when working with Laravel, Eloquent, Blade, artisan, or building/testing a framework-based PHP app. Not for php-src internals, standalone PHP libraries, or general PHP language discussion.
Test Scaffold (Laravel/PHPUnit)
Generate PHP/Laravel (PHPUnit) test skeletons from specifications.
Laravel Migration Safety Review
Reviews Laravel migrations for destructive operations, change() dropping modifiers, locking index creation on large tables (PostgreSQL), and asymmetric down().
craftcms
Craft CMS 5 plugin and module development — extending Craft with PHP. Covers elements, element queries, services, models, records, controllers, migrations, queue jobs, console commands, field types, native fields, events, behaviors, Twig extensions, widgets, filesystems, permissions, project config, GraphQL, testing…
craft-php-guidelines
Craft CMS 5 PHP coding standards and conventions. ALWAYS load when writing, editing, reviewing, or discussing any PHP in a Craft plugin or module — even small edits. Also when running ECS, PHPStan, or scaffolding with ddev craft make. Covers: PHPDoc blocks (@author, @since, @throws chains), section headers…