Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nimadorostkar/Claude-Skills-collection --skill phpgit clone --depth 1 https://github.com/nimadorostkar/Claude-Skills-collectionWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nimadorostkar/claude-skills-collection/php)<a href="https://agentmods.dev/skills/nimadorostkar/claude-skills-collection/php"><img src="https://agentmods.dev/badge/skills/nimadorostkar/claude-skills-collection/php/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nimadorostkar/claude-skills-collection/php"><img src="https://agentmods.dev/badge/skills/nimadorostkar/claude-skills-collection/php.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.00804 |
| Opus 5 | $0.00021 | $0.00402 |
| Sonnet 5 | $0.00008 | $0.00161 |
| Haiku 4.5 | $0.00004 | $0.00080 |
Grade A, and why
php scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PHP
Purpose
Write PHP that behaves like a typed language: strict types on, enums instead of string constants, readonly value objects, and PHPStan at a level high enough to catch real defects.
When to Use
- Writing or reviewing PHP 8.2+.
- Working in Laravel or Symfony applications.
- Introducing static analysis to a legacy PHP codebase.
- Modeling domain values and states.
- Fixing performance problems in ORM-heavy code.
Capabilities
- Strict typing, union and intersection types,
neverandreadonly. - Enums with backing values and interfaces.
- Attributes for routing, validation, and DI metadata.
- PSR-4 autoloading, PSR-12 style, PSR-3 logging.
- PHPStan configuration and incremental adoption via baselines.
Inputs
- Source tree,
composer.json, framework and version. - Existing analysis configuration and baseline, if any.
Outputs
- Files opening with
declare(strict_types=1);. - Typed properties, parameters, and return types throughout.
- A PHPStan configuration at level 8 (or a baseline plus a plan to reach it).
Workflow
- Turn on strictness —
declare(strict_types=1)in every file; PHPStan with a baseline to freeze existing debt. - Replace magic with types — String constants become enums; array shapes become value objects or DTOs.
- Implement — Constructor promotion, readonly properties, named arguments at call sites.
- Eliminate ORM traps — Eager-load relations; never query inside a loop.
- Gate — PHPStan, PHP-CS-Fixer, PHPUnit or Pest.
Best Practices
- Never use
arrayas a domain type. An untyped array is a shape that no tool can check. - Enums replace class constants and give you exhaustive
match. - Readonly promoted constructor properties are the shortest path to immutable value objects.
- In Eloquent,
with()your relations. An N+1 query in a list endpoint is the single most common PHP performance defect. - Do not catch
\Exceptionbroadly. Catch the specific type, or let it reach the handler. - Keep framework types out of the domain layer — a domain service should not know what an HTTP request is.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 99 lines · 42 tokens per session scan A ab9ac6eb8425
php is a skill published in the GitHub repository nimadorostkar/Claude-Skills-collection (26 stars, last pushed 22d ago), licensed MIT. It adds 42 tokens to every session and 804 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
emlog-app-dev
A development guide for Emlog, a PHP-based blogging and content-management system. It covers building and changing Emlog plugins, themes, templates, and related code.
laravel-specialist
Build and configure Laravel 10+ applications, including creating Eloquent models and relationships, implementing Sanctum authentication, configuring Horizon queues, designing RESTful APIs with API resources, and building reactive interfaces with Livewire. Use when creating Laravel models, setting up queue workers…
php-pro
Use when building PHP applications with modern PHP 8.3+ features, Laravel, or Symfony frameworks. Invokes strict typing, PHPStan level 9, async patterns with Swoole, and PSR standards. Creates controllers, configures middleware, generates migrations, writes PHPUnit/Pest tests, defines typed DTOs and value objects…
auditing-php-applications
Audit PHP web application source for critical vulnerabilities using PHP's specific sink and footgun catalog — object injection via unserialize and phar:// POP chains, type-juggling and magic-hash auth bypass, LFI/RFI through php:// and phar:// wrappers, dynamic includes and extract()/superglobal trust, SQL injection…
craftcms
Craft CMS 5 plugin and module development — extending Craft with PHP. Covers elements, element queries, services, models, records, controllers, migrations, queue jobs, console commands, field types, native fields, events, behaviors, Twig extensions, widgets, filesystems, permissions, project config, GraphQL, testing…
craft-php-guidelines
Craft CMS 5 PHP coding standards and conventions. ALWAYS load when writing, editing, reviewing, or discussing any PHP in a Craft plugin or module — even small edits. Also when running ECS, PHPStan, or scaffolding with ddev craft make. Covers: PHPDoc blocks (@author, @since, @throws chains), section headers…