php-pro

An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: api, developer-tools, php, security, testing, web.

What it does

Use when building PHP applications with modern PHP 8.3+ features, Laravel, or Symfony frameworks. Invokes strict typing, PHPStan level 9, async patterns with Swoole, and PSR standards. Creates controllers, configures middleware, generates migrations, writes PHPUnit/Pest tests, defines typed DTOs and value objects, sets up dependency injection, and scaffolds REST/GraphQL APIs. Use when working with Eloquent, Doctrine, Composer, Psalm, ReactPHP, or any PHP API development.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add Jeffallan/claude-skills --skill php-pro

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/php-pro ~/.claude/skills/php-pro

Safety box score

Grade B, low risk: 16 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a PHP application scaffolding/implementation guide: it generates controllers, services, migrations, tests, and async/server code for Laravel/Symfony-style projects. The main risks are running local test/static-analysis commands, broad edits inside the project tree, and wiring secrets/config from environment variables into generated code.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It explicitly tells the agent to run local commands like `vendor/bin/phpstan analyse --level=9` and `vendor/bin/phpunit`/`vendor/bin/pest`, but only against the project’s own code.
Network access	1 (low)	The reference files include network-facing examples (`Swoole`/`ReactPHP` servers on `0.0.0.0` and requests to `https://api.example.com/...`), but there is no downloader or remote installer.
Filesystem reach	1 (low)	Its purpose is to create and edit application files in the repo (`controllers`, `middleware`, `migrations`, `tests`, `config`), but it does not call for writes outside the project tree.
Secrets & credentials	1 (low)	It recommends `.env`-based config and shows secret-bearing env usage like `%env(PAYMENT_API_KEY)%`, but it does not ask for keychain/browser/token-store access.
Privilege & persistence	0 (none)	No `sudo`, global installs, services, scheduled tasks, or OS/shell configuration changes are requested.
Instruction hijack surface	0 (none)	There is no prompt injection, instruction to ignore higher-priority rules, or hidden/remote text to follow.
Irreversible actions	0 (none)	It does not post, deploy, pay, book, merge, or delete resources; it only generates code and instructs local verification.
Transparency	0 (none)	All shipped files are readable markdown; there are no binaries, encoded blobs, or runtime-downloaded code.

Before installing

Check whether your repo’s tests are safe to run locally; this skill will invoke `phpstan`, `phpunit`, or `pest`.
Review `references/async-patterns.md` if you do not want code that opens listeners on `0.0.0.0` or makes outbound HTTP/MySQL calls.
Confirm your `.env` and other secrets are not exposed in the prompt context before letting the agent implement config changes.
If you want tighter scope, only allow edits under the project tree (`src/`, `tests/`, `config/`) and avoid letting it touch deployment scripts.

Rated 2026-10-20 by an automated review of 6 files from the skill's repository.

Source

Repository: Jeffallan/claude-skills (all skills from this repository)
Path: skills/php-pro/SKILL.md
Branch: main
Updated: 2026-09-19

laravel-specialist — Build and configure Laravel 10+ applications, including creating Eloquent models and relationships, implementing Sanctum authentication.
nestjs-expert — Creates and configures NestJS modules, controllers, services, DTOs, guards, and interceptors for enterprise-grade TypeScript backend applications.
wordpress-pro — Develops custom WordPress themes and plugins, creates and registers Gutenberg blocks and block patterns, configures WooCommerce stores.
aws-auth — Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries.
pentesting-with-aws-security-agent — Run an AWS Security Agent penetration test against a live web application — registers and verifies the target domain.
running-release-tests — Run automated release testing (UI or API) via the AWS DevOps Agent using a pre-configured test profile.