A guide to reorganising old PHP applications around Model-View-Controller, a structure that separates data access, page output, and application control. It also covers modern PHP and common PHP coding standards.

Use it to audit legacy PHP files, separate routes and responsibilities, replace inline SQL and global state, and plan a safer modernisation.

It helps make tangled PHP code easier to understand and maintain while identifying unsafe database queries, session handling, and unchecked user input.

mvc-expert — Skill for Cursor by roedyrustam/vibes-plug

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add roedyrustam/vibes-plug --skill mvc-expert

Clone the repo

git clone --depth 1 https://github.com/roedyrustam/vibes-plug

Made for: Cursor.

Or install vibes-plug, the plugin that ships this one along with the rest of its 171 skills, 8 agents, 2 MCP servers.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/roedyrustam/vibes-plug/mvc-expert/github.svg)](https://agentmods.dev/skills/roedyrustam/vibes-plug/mvc-expert)

Your own site

<a href="https://agentmods.dev/skills/roedyrustam/vibes-plug/mvc-expert"><img src="https://agentmods.dev/badge/skills/roedyrustam/vibes-plug/mvc-expert/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/roedyrustam/vibes-plug/mvc-expert"><img src="https://agentmods.dev/badge/skills/roedyrustam/vibes-plug/mvc-expert.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 51 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,474 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00051	$0.03474
Opus 5.5	$0.00020	$0.01390
Sonnet 5.5	$0.00010	$0.00695
Haiku 4.5	$0.00005	$0.00347

Measured 2d ago against content hash db2715c1625a, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

mvc-expert scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/skills/mvc-expert/SKILL.md · 249 lines

How it starts

The opening of the file, as written. The whole thing — 249 lines — stays where its author put it; the contents beside it link to each section on GitHub.

PHP MVC Expert & Modernization

English | Bahasa Indonesia

English

Orchestration & Integration

Connects and orchestrates with domain skills:

Modernization & Translation: legacy-code-translator (migrating legacy PHP to modern stacks like Next.js, Node.js, Go, or Laravel) and zero-tech-debt-auditor (eradicating dead spaghetti scripts).
Architecture & Routing: mpa-orchestrator (centralized Front Controller and shared layouts) and api-design-expert (converting raw PHP endpoints into RESTful APIs).
Security & Database: database-orm-expert (migrating raw mysql_* to PDO prepared statements) and zero-trust-secret-vault (replacing hardcoded credentials with .env).
Quality & Anti-Slop: anti-slop (eliminating code smells, strict type declarations declare(strict_types=1);).
Orchestration: brainstorming and zero-to-prod-orchestrator.

Description

This skill provides the agent with structured protocols, coding patterns, and architectural guidelines to audit, refactor, and modernize legacy/obsolete PHP codebases (plain spaghetti PHP) into a clean, modern, secure, and scalable Model-View-Controller (MVC) structure adhering to PSR standards and modern PHP (v8.2+) capabilities.

Instructions

1. Audit Protocol for Legacy PHP

Before writing new structures, run a detailed audit on the legacy files to map out:

Routing & Entry Points: Identify raw .php files acting as endpoints (e.g., about.php, contact.php, process.php).
Data Access & SQL: Find inline SQL queries, string-concatenated queries (SQL Injection risks), and direct mysqli or mysql_* usages.
Session & Global State: Identify direct session mutations ($_SESSION), raw cookies, and unchecked global variables ($_GET, $_POST, $_REQUEST).
Spaghetti Mixing: Locate files where database connection, business logic, session validation, and HTML rendering are in a single script.
Hardcoded Secrets: Identify database credentials, API keys, and configurations defined inside individual files.

Read the full file on GitHub · 249 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago Changed · +9 lines · +51 tokens per session db2715c1625a
3d ago Changed · +2 lines · -51 tokens per session f5b2cb793806
6d ago Changed 4869296f3717
15d ago Changed b6e3ae37486b
20d ago Changed 0721529c6db7
21d ago Changed c5f1c8a65075
23d ago Changed · -6 lines · +42 tokens per session 595e8382229f
25d ago Changed · +6 lines · -42 tokens per session 259b27bb9533
1mo ago Changed 06eaa74f114e
1mo ago First seen · 238 lines · 51 tokens per session scan A 78c8ed447c51

Subscribe to this mod's changes

mvc-expert is a skill published in the GitHub repository roedyrustam/vibes-plug (113 stars, last pushed today), licensed MIT. It adds 51 tokens to every session and 3,474 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Backend and APIs LLM Languages PHP ai-agents antigravity developer-tools prompt-engineering skills

laravel

Expert Laravel assistance covering Eloquent ORM, Blade templating, queues, service providers, and Artisan CLI. Use when developing enterprise PHP web applications and robust REST APIs.

G1Joshi/Agent-Skills · 36 tokens

symfony

Expert Symfony assistance covering PHP HTTP kernel, Twig, Doctrine ORM, services, and MakerBundle. Use when building enterprise PHP applications and web services.

G1Joshi/Agent-Skills · 32 tokens

neuron-symfony-integration

Integrate Neuron AI agents into a Symfony 8 app, from packages, env keys, a Doctrine migration for the Neuron tables and services.yaml wiring to a shared agent bound per request with for(), a thread voter, JSON and AG-UI (CopilotKit) or useChat streaming with StreamedResponse, reload with pending approvals, Messenger…

neuron-core/neuron-ai · 221 tokens

laravel-expert

Laravel & PHP Development Instructions for GitHub Copilot.

GulajavaMinistudio/awesome-copilot-id · 15 tokens

zcfg

Integrate zcfg (Zero Dependency Configuration Utility) into Java applications. Use when adding configuration loading, reading properties files, setting up application configuration, or integrating zcfg into a Java project. Triggers on "zcfg", "add configuration", "load properties", "application configuration with…

AdamBien/airails · 75 tokens

rails-dev

Opinionated Rails conventions: rich models, concerns, CRUD-everything, state-as-records, minimal dependencies, Minitest with fixtures. Load this skill BEFORE any code-level thinking, not only before editing a file. It is required the moment a task touches Rails code in ANY way: designing or even just discussing a data…

tech-leads-club/agent-skills · 199 tokens