Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vynazevedo/first-plan --skill lens-phpgit clone --depth 1 https://github.com/vynazevedo/first-planWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vynazevedo/first-plan/lens-php)<a href="https://agentmods.dev/skills/vynazevedo/first-plan/lens-php"><img src="https://agentmods.dev/badge/skills/vynazevedo/first-plan/lens-php/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vynazevedo/first-plan/lens-php"><img src="https://agentmods.dev/badge/skills/vynazevedo/first-plan/lens-php.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.00913 |
| Opus 5.5 | $0.00020 | $0.00365 |
| Sonnet 5.5 | $0.00010 | $0.00183 |
| Haiku 4.5 | $0.00005 | $0.00091 |
Grade A, and why
first-plan-lens-php scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 124 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Lens PHP
Detecção fina
| Sinal | Variante |
|---|---|
artisan na raiz |
Laravel |
bin/console + symfony/framework-bundle em deps |
Symfony |
slim/slim em deps |
Slim |
hyperf/hyperf em deps |
Hyperf |
laminas/laminas-mvc em deps |
Laminas (Zend) |
index.php em public/ sem framework |
Legacy / vanilla |
wp-config.php |
WordPress |
Extração de padrões
Composer
- PSR-4 autoload mappings (qual namespace -> qual pasta)
- Versão min de PHP (
require.php) - Dev dependencies relevantes (phpunit, phpstan, psalm, php-cs-fixer, rector)
Estrutura
Laravel:
app/Http/Controllers,app/Models,app/Services,app/Repositoriesroutes/{web,api,console,channels}.phpdatabase/migrations,database/seeders,database/factoriesconfig/,resources/,bootstrap/
Symfony:
src/Controller,src/Entity,src/Repository,src/Serviceconfig/services.yaml,config/routes.yamlmigrations/
Dependency Injection
- Laravel: container service, providers em
app/Providers/, binding emregister() - Symfony: services.yaml, autowire, autoconfigure
- Manual em vanilla
Errors
- Exceptions customizadas (extends Exception ou DomainException)
- Handler global (Laravel:
app/Exceptions/Handler.php; Symfony: ExceptionListener) - HTTP error mapping
Validação
- Laravel: Form Requests em
app/Http/Requests/, rules - Symfony: Validator constraints / annotations
- Manual via if's
ORM
- Eloquent (Laravel)
- Doctrine (Symfony)
- Query Builder direto
- PDO raw
Testing
- PHPUnit (mais comum)
- Pest (alternativa moderna)
- Pasta
tests/comUnit,Feature,Integration - Factories Laravel / fixtures Doctrine
- Mocks com Mockery
Filas / Mensageria
- Laravel: Horizon, jobs em
app/Jobs/ - Symfony: Messenger
- Hyperf: AMQP, Kafka
Static analysis
- PHPStan level configurado (8 = strict)
- Psalm
- PHP-CS-Fixer rules
- Rector rules
PSR compliance
- PSR-12 (style) - verificar via php-cs-fixer config
- PSR-7 (HTTP messages) - check em libs como
slim/psr7,nyholm/psr7 - PSR-15 (HTTP middleware)
- PSR-3 (logger interface)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 124 lines · 51 tokens per session scan A ebc9bf8fc43e
first-plan-lens-php is a skill published in the GitHub repository vynazevedo/first-plan (24 stars, last pushed 1mo ago), licensed MIT. It adds 51 tokens to every session and 913 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
laravel-patterns
Laravel architecture patterns, routing/controllers, Eloquent ORM, service layers, queues, events, caching, and API resources for production apps.
laravel-security
Laravel security best practices for authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.
laravel-plugin-discovery
Discover and evaluate Laravel packages via LaraPlugins.io MCP. Use when the user wants to find plugins, check package health, or assess Laravel/PHP compatibility.
laravel
Use when building or extending a Laravel 11/12 app — Eloquent models, migrations and relationships, routing with controllers and Form Requests, queues and background jobs, framework-native security (validation, mass-assignment, policies, signed URLs, rate limiting), and Pest/PHPUnit feature tests. NOT pure PHP…
php
Use when writing, reviewing or modernizing PHP (8.3-8.5) outside Laravel — strict types, union and intersection types, readonly classes, backed enums, property hooks and asymmetric visibility, the pipe operator and clone-with, Composer with PSR-4, PER-CS style, PSR interop, and the quality toolchain (PHPStan, Pint…
llamaindex-development
Expert guidance for LlamaIndex development including RAG applications, vector stores, document processing, query engines, and building production AI applications.