Borrowing it
Nothing to install: this file belongs to MrPunyapal/laravel-auditor. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/MrPunyapal/laravel-auditor/main/.agents/skills/package-compatibility/SKILL.mdgit clone --depth 1 https://github.com/MrPunyapal/laravel-auditorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mrpunyapal/laravel-auditor/package-compatibility)<a href="https://agentmods.dev/skills/mrpunyapal/laravel-auditor/package-compatibility"><img src="https://agentmods.dev/badge/skills/mrpunyapal/laravel-auditor/package-compatibility/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mrpunyapal/laravel-auditor/package-compatibility"><img src="https://agentmods.dev/badge/skills/mrpunyapal/laravel-auditor/package-compatibility.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.00371 |
| Opus 5 | $0.00021 | $0.00186 |
| Sonnet 5 | $0.00008 | $0.00074 |
| Haiku 4.5 | $0.00004 | $0.00037 |
Grade A, and why
package-compatibility scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to package-compatibility — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
What it actually says
Package Compatibility
Primary Goal
Keep package code, dependencies, and workflows compatible with the supported Laravel 12/13 and PHP 8.3+ matrix.
Workflow
- Read
composer.jsonfirst to determine PHP, Laravel, and Testbench constraints. - Check changed code against Laravel 12/13 APIs and PHP 8.3+ syntax before adopting newer framework or language features.
- Review
.github/workflows/tests.ymlfor dependency stability lanes, prefer-lowest coverage, prefer-stable coverage, and Windows concerns. - When changing dependencies, confirm constraints still allow the intended Laravel and Testbench versions.
- Validate with the smallest local command available, then rely on CI for full OS and dependency matrix coverage.
References
composer.json.github/workflows/tests.ymlphpstan.neon.disttests/workbench/
Examples
- Review a new Laravel API call by checking whether it exists in Laravel 12 and Laravel 13 before merging it into shared package code.
- Review a dependency bump by checking Composer constraints, Testbench constraints, prefer-lowest behavior, and Windows path assumptions.
Anti-Patterns
- Assuming the latest local dependency version represents the whole support matrix.
- Adding PHP syntax or Laravel APIs that exceed
composer.jsonconstraints. - Ignoring Windows path separators, executable assumptions, or shell-only syntax in tests and workflows.
- Removing dependency stability lanes because they are slower than a single happy path.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 42 lines · 42 tokens per session scan A 49221e1226f2
package-compatibility is a skill published in the GitHub repository MrPunyapal/laravel-auditor (47 stars, last pushed 5d ago), licensed MIT. It adds 42 tokens to every session and 371 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to package-compatibility, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
代码审查员
A code-review agent that examines changes for correctness, security, maintainability, performance, and test coverage.
capstone-radar
Unified A-F grading and ship/no-ship decisions for the 6-skill radar family (5 companions + capstone). Aggregates handoffs from data-model, ui-path, roundtrip, time-bomb, and ui-enhancer; owns 5 grep-reliable domains; tracks velocity; celebrates improvements. Triggers: "capstone radar", "can I ship", "grade codebase"…
time-bomb-radar
Finds deferred operations that crash on aged data -- code that passes every test but breaks weeks or months after release. Covers cascade deletes, cache expiry, trial paths, background accumulation, date-threshold transitions, and scheduled side effects. Triggers: "time bomb", "time-bomb", "/time-bomb-radar", "aged…
radar-suite
Unified entry point for the 6-skill radar family (5 companions + capstone). Routes to individual skills, runs targeted (Tier 2) or full (Tier 3) audit sequences, owns the unified ledger, and provides cross-skill operations (status, verify, ledger, link, deferred, fresh/no-fresh). Triggers: "radar suite", "full audit"…
radar-suite-axis-classification
Shared axis classification framework for all radar-suite skills. Every finding must be classified as axis1 (bug), axis2 (scatter), or axis3 (dead/smelly) before emission, with mandatory coaching fields and file:line citations to existing patterns in the audited codebase. Triggers: invoked by every radar before…
Tech Debt Auditor
Identifies and prioritizes technical debt in a codebase with an effort/impact matrix.