Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/loulanyue/awesome-claude-notesnpx agentmods add skills/loulanyue/awesome-claude-notes/laravel-verificationWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/loulanyue/awesome-claude-notes/laravel-verification)<a href="https://agentmods.dev/skills/loulanyue/awesome-claude-notes/laravel-verification"><img src="https://agentmods.dev/badge/skills/loulanyue/awesome-claude-notes/laravel-verification/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/loulanyue/awesome-claude-notes/laravel-verification"><img src="https://agentmods.dev/badge/skills/loulanyue/awesome-claude-notes/laravel-verification.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.01067 |
| Opus 5 | $0.00015 | $0.00534 |
| Sonnet 5 | $0.00006 | $0.00213 |
| Haiku 4.5 | $0.00003 | $0.00107 |
Grade A, and why
laravel-verification scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
92% identical to laravel-verification — 11 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 189 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Laravel Verification Loop
Run before PRs, after major changes, and pre-deploy.
When to Use
- Before opening a pull request for a Laravel project
- After major refactors or dependency upgrades
- Pre-deployment verification for staging or production
- Running full lint -> test -> security -> deploy readiness pipeline
How It Works
- Run phases sequentially from environment checks through deployment readiness so each layer builds on the last.
- Environment and Composer checks gate everything else; stop immediately if they fail.
- Linting/static analysis should be clean before running full tests and coverage.
- Security and migration reviews happen after tests so you verify behavior before data or release steps.
- Build/deploy readiness and queue/scheduler checks are final gates; any failure blocks release.
Phase 1: Environment Checks
php -v
composer --version
php artisan --version
- Verify
.envis present and required keys exist - Confirm
APP_DEBUG=falsefor production environments - Confirm
APP_ENVmatches the target deployment (production,staging)
If using Laravel Sail locally:
./vendor/bin/sail php -v
./vendor/bin/sail artisan --version
Phase 1.5: Composer and Autoload
composer validate
composer dump-autoload -o
Phase 2: Linting and Static Analysis
vendor/bin/pint --test
vendor/bin/phpstan analyse
If your project uses Psalm instead of PHPStan:
vendor/bin/psalm
Phase 3: Tests and Coverage
php artisan test
Coverage (CI):
XDEBUG_MODE=coverage php artisan test --coverage
CI example (format -> static analysis -> tests):
vendor/bin/pint --test
vendor/bin/phpstan analyse
XDEBUG_MODE=coverage php artisan test --coverage
Phase 4: Security and Dependency Checks
composer audit
Phase 5: Database and Migrations
php artisan migrate --pretend
php artisan migrate:status
- Review destructive migrations carefully
- Ensure migration filenames follow
Y_m_d_His_*(e.g.,2025_03_14_154210_create_orders_table.php) and describe the change clearly - Ensure rollbacks are possible
- Verify
down()methods and avoid irreversible data loss without explicit backups
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 189 lines · 0 tokens per session scan A bc8c11719118
laravel-verification is a skill published in the GitHub repository loulanyue/awesome-claude-notes (270 stars, last pushed 7d ago), licensed MIT. It adds 31 tokens to every session and 1,067 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 92% identical to laravel-verification, differing in 11 lines, and is treated as a copy.
Other skills, from other repositories
playwright-testing
E2E testing with Playwright - Page Objects, cross-browser, CI/CD.
safe-extraction
Apply when extracting code from a large monolith file into submodules. Covers barrel re-exports, internals DI seam proxy patterns, CI invariant allowlist updates, and cross-file test verification. Prevents CI failures, broken imports, and test regressions from code extraction.
safe-rename
Workflow for safely renaming symbols (functions, types, classes, interfaces, constants, variables) across a codebase. Uses repomap, batchsymbols, and buildcheck to ensure every consumer is updated and nothing breaks.
rust-crate-ci
Load before editing any Rust crate in this repo (currently runners/swarm-sandbox-runner). Covers the mandatory local validation gate, common rustfmt/clippy pitfalls, and Windows-specific Rust correctness patterns that CI enforces but are hard to catch locally without a Windows toolchain.
test-file-split
Protocol for splitting test files that approach or exceed the FR-006 500-line limit (enforced in CI by scripts/check-test-file-cap.ts as a diff-scoped ratchet). Covers describe-block extraction, shared helper management, pure-function extraction, mock isolation verification, and cascading-split detection. Load when a…
ci-failure-batching
Batch collection and fix protocol for CI failures. Triggered when any CI check fails on a PR. Prevents serial diagnose-fix-push cycles by collecting all failures before fixing.