Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/loulanyue/awesome-claude-notesnpx agentmods add skills/loulanyue/awesome-claude-notes/laravel-verificationWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/loulanyue/awesome-claude-notes/laravel-verification)<a href="https://agentmods.dev/skills/loulanyue/awesome-claude-notes/laravel-verification"><img src="https://agentmods.dev/badge/skills/loulanyue/awesome-claude-notes/laravel-verification/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/loulanyue/awesome-claude-notes/laravel-verification"><img src="https://agentmods.dev/badge/skills/loulanyue/awesome-claude-notes/laravel-verification.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01067 |
| Opus 5.5 | $0.00000 | $0.00427 |
| Sonnet 5.5 | $0.00000 | $0.00213 |
| Haiku 4.5 | $0.00000 | $0.00107 |
Grade A, and why
laravel-verification scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
92% identical to laravel-verification — 11 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 189 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Laravel Verification Loop
Run before PRs, after major changes, and pre-deploy.
When to Use
- Before opening a pull request for a Laravel project
- After major refactors or dependency upgrades
- Pre-deployment verification for staging or production
- Running full lint -> test -> security -> deploy readiness pipeline
How It Works
- Run phases sequentially from environment checks through deployment readiness so each layer builds on the last.
- Environment and Composer checks gate everything else; stop immediately if they fail.
- Linting/static analysis should be clean before running full tests and coverage.
- Security and migration reviews happen after tests so you verify behavior before data or release steps.
- Build/deploy readiness and queue/scheduler checks are final gates; any failure blocks release.
Phase 1: Environment Checks
php -v
composer --version
php artisan --version
- Verify
.envis present and required keys exist - Confirm
APP_DEBUG=falsefor production environments - Confirm
APP_ENVmatches the target deployment (production,staging)
If using Laravel Sail locally:
./vendor/bin/sail php -v
./vendor/bin/sail artisan --version
Phase 1.5: Composer and Autoload
composer validate
composer dump-autoload -o
Phase 2: Linting and Static Analysis
vendor/bin/pint --test
vendor/bin/phpstan analyse
If your project uses Psalm instead of PHPStan:
vendor/bin/psalm
Phase 3: Tests and Coverage
php artisan test
Coverage (CI):
XDEBUG_MODE=coverage php artisan test --coverage
CI example (format -> static analysis -> tests):
vendor/bin/pint --test
vendor/bin/phpstan analyse
XDEBUG_MODE=coverage php artisan test --coverage
Phase 4: Security and Dependency Checks
composer audit
Phase 5: Database and Migrations
php artisan migrate --pretend
php artisan migrate:status
- Review destructive migrations carefully
- Ensure migration filenames follow
Y_m_d_His_*(e.g.,2025_03_14_154210_create_orders_table.php) and describe the change clearly - Ensure rollbacks are possible
- Verify
down()methods and avoid irreversible data loss without explicit backups
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 189 lines · 0 tokens per session scan A bc8c11719118
laravel-verification is a skill published in the GitHub repository loulanyue/awesome-claude-notes (271 stars, last pushed 26d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,067 tokens. A static security scan graded it A with 0 findings. It is 92% identical to laravel-verification, differing in 11 lines, and is treated as a copy.
Other skills, from other repositories
playwright-testing
E2E testing with Playwright - Page Objects, cross-browser, CI/CD.
github-actions
Use when authoring or fixing GitHub Actions CI/CD — workflows under .github/workflows, triggers, job matrix, caching, token permissions, OIDC cloud deploys, environment gates, reusable workflows. NOT the Dockerfile or image build strategy (that is docker), NOT the branching model (that is git-workflow), NOT release…
ci-all
Full CI pipeline: run local tests, type check, push branch, and return the pipeline URL. The only command you need before opening a PR.
azure-devtest-labs
Expert knowledge for Azure DevTest Labs development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when managing lab VM images, ARM/CI-CD automation, RBAC/Key Vault security…
boolean-flag-responses
Design boolean or enum outputs for narrow diagnostic and triage tasks whose full result fits a fixed set of values.
post-deploy-verifier
Per-slice post-deploy verification plan: acceptance criteria mapped to live signals, plus rollback triggers. Activates after a deploy with no plan, when branch-commit made a deploy without checks, or when slice-closure would close a slice without one. Do not use before the slice ships (use verify-against-rubric), for…