Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add s977043/river-review --skill laravel-migration-safetygit clone --depth 1 https://github.com/s977043/river-reviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/s977043/river-review/laravel-migration-safety)<a href="https://agentmods.dev/skills/s977043/river-review/laravel-migration-safety"><img src="https://agentmods.dev/badge/skills/s977043/river-review/laravel-migration-safety/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/s977043/river-review/laravel-migration-safety"><img src="https://agentmods.dev/badge/skills/s977043/river-review/laravel-migration-safety.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00032 | $0.00921 |
| Opus 5 | $0.00016 | $0.00461 |
| Sonnet 5 | $0.00006 | $0.00184 |
| Haiku 4.5 | $0.00003 | $0.00092 |
Grade A, and why
Laravel Migration Safety Review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Pattern declaration
Primary pattern: Reviewer Secondary patterns: Inversion Why: migration の破壊的・ロック誘発操作をチェックリスト型で検査する
Goal / 目的
change()による修飾子の意図しない消失（公式: 保持したい修飾子をすべて再指定しないと消える）を検出する。- 破壊的操作（dropColumn 等）と、大規模テーブルでのロック誘発 index 追加を検出する。
Non-goals / 扱わないこと
- データモデル設計の妥当性（
data-model-db-designのスコープ）。 - アプリ側クエリ効率（
laravel-eloquent-nplus1のスコープ）。
Pre-execution Gate / 実行前ゲート
このスキルは以下の条件がすべて満たされない限りNO_REVIEWを返す。
- 差分に
database/migrations/配下の追加変更が含まれている - diff コンテキストが利用可能である
ゲート不成立時の出力: NO_REVIEW: laravel-migration-safety — migration の変更なし
False-positive guards / 抑制条件
- 新規テーブル作成（
Schema::create）内の index 追加はロック問題がないため指摘しない。 down()の非対称は、データ変換系 migration で完全な逆操作が不可能なケースが正当（コメントで明示があれば許容）。dropColumnが「別 PR で deprecate 済みカラムの計画的削除」と明示されている場合は指摘しない。
Rule / ルール
change()時は保持したい修飾子（unsigned/default/comment/nullable等）をすべて再指定する。dropColumn/Schema::drop等の破壊的操作は影響とロールバック不能性を確認する（本番--force実行に注意）。- PostgreSQL の大規模テーブルへの index 追加は
->online()（CREATE INDEX CONCURRENTLY）を検討する。併せてトランザクション外実行が必要な副作用も指摘する。 down()はup()の逆操作として整合させる。
Evidence / 根拠の取り方
- 指摘は
<file>:<line>で差分に紐づけ、公式規約（laravel.com/docs/12.x/migrations#modifying-columns 等）を 1 行で添える。 - テーブル規模が diff から不明な場合は
online()提案を断定せずquestionsで返す。
Output / 出力（短文版の推奨）
コメントは日本語で返す。
- Finding: 修飾子消失 / 破壊的操作 / ロック誘発のどれか（1文）
- Impact: データ損失 / 本番ロック / ロールバック不能
- Fix: 修飾子の再指定 /
online()/down()整合の最小案
Sources / 出典
- Laravel 12.x — Migrations (modifying columns / dropping / online index): https://laravel.com/docs/12.x/migrations#modifying-columns
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 71 lines · 32 tokens per session scan A b842cfb2693c
Laravel Migration Safety Review is a skill published in the GitHub repository s977043/river-review (3 stars, last pushed yesterday), licensed MIT. It adds 32 tokens to every session and 921 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
decide-casts
When to use Eloquent Cast vs Accessor. Value representation decisions.
laravel-migrations
Use when designing a database schema or managing Laravel 13 migrations — Schema Builder, columns, indexes, foreign keys, or seeders.
php-laravel
Modern PHP 8.2+ and Laravel patterns: architecture, Eloquent, queues, Pest testing. Use when asked to "write PHP", "build a Laravel app", "fix Eloquent query", "add a queue job", "write a Pest test", or mentions PHP, Laravel, Eloquent, Blade, artisan, or migrations.
ia-php-laravel
Modern PHP 8.4 and Laravel patterns: architecture, Eloquent, migrations, queues, testing. Use when working with Laravel, Eloquent, Blade, artisan, or building/testing a framework-based PHP app. Not for php-src internals, standalone PHP libraries, or general PHP language discussion.
laravel-eloquent
Eloquent and query-layer engineering rules for Laravel — eliminating N+1, choosing a pagination strategy, short atomic transactions, casts and scopes on the model, where raw SQL is allowed, and how migrations declare the schema those queries depend on. Use when writing or reviewing Eloquent models, migrations, query…
dhpk-composer-package-hygiene
Composer-published package contract review. Use when: deciding semver, auditing public API or composer.json, validating Laravel package discovery, or coordinating a package release. Not for: everyday application code, language idioms, or Laravel-specific authoring mechanics. Output: a contract verdict, audited…