skills.rest
jhannka
jhannkaCOMMUNITY
Explore all skills by this author →
GitHub

prism-laravel-audit-rules

Applies PRISM-derived audit rules to Laravel 5.4 and PHP 7.2 code reviews.

Updated Aug 28, 2026
Search Tags:#static analysis#code review#pull request#php#security audit#laravel#version compatibility
One-click install
npx skills add https://github.com/jhannka/php-skills --skill prism-laravel-audit-rules-jhannka
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: prism-laravel-audit-rules
Source: https://github.com/jhannka/php-skills/tree/main/skills/prism-laravel-audit-rules
Command: npx skills add https://github.com/jhannka/php-skills --skill prism-laravel-audit-rules-jhannka

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Reviewing PHP and Laravel code without version awareness leads to broken suggestions — proposing PHP 8 syntax on a PHP 7.2 runtime, or Laravel 8 APIs like upsert() and now() on a Laravel 5.4.36 codebase causes fatal errors in production. This Skill encodes the exact audit rules from the PRISM code-audit tool's seven Laravel reviewer agents, plus repo-specific corrections learned from real production incidents. ## Core Features & Use Cases - Version-gated review rules: Blocks suggestions of PHP 7.4+/8.x syntax (typed properties, match, nullsafe operator) and Laravel 5.5+ APIs (validated(), upsert(), now()) that do not exist on the pinned PHP 7.2.34 / Laravel 5.4.36 stack. - Seven reviewer rule sets: Mirrors PRISM's php-reviewer, blade-reviewer, security-reviewer, architecture-reviewer, testing-reviewer, config-reviewer, and performance-reviewer prompts, covering SQL injection, unescaped Blade output, N+1 queries, Docker Compose misconfigurations, and weak test assertions. - Repo-specific false-positive corrections: Documents exceptions verified against production incidents, such as FormRequest resolution inside BaseController overrides, seeder calls inside migrations, and safe exception-logging patterns. - Use Case: When auditing a pull request that adds a batch sync command, the Skill prevents suggesting Model::upsert() (fatal in Laravel 5.4) and instead prescribes the correct whereIn() read plus bulk insert() pattern. ## Quick Start Ask the agent to review the changed PHP, Blade, migration, or Docker Compose files in this pull request using the PRISM Laravel audit rules.

Frequently Asked Questions about prism-laravel-audit-rules

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review Laravel 5.4 code without suggesting incompatible APIs?▼

Verify the exact installed version in composer.lock before suggesting any framework API. Methods like upsert(), now(), and FormRequest::validated() were added in Laravel 5.5 through 8.x and cause fatal errors on 5.4.36; use whereIn() plus bulk insert() and Carbon::now() instead.

How to check which PHP version features are safe to suggest?▼

Confirm the real runtime version with docker exec <container> php -v rather than inferring it from the composer.json constraint, which only pins the minor version. On PHP 7.2, typed properties, match, nullsafe operators, and union types are all parse errors.

What does the PRISM Laravel reviewer actually check?▼

PRISM routes Laravel-detected repos to seven agents: php, blade, security, architecture, testing, config, and performance reviewers. They cover SQL injection, unescaped Blade output, missing CSRF directives, N+1 queries, weak test assertions, and Docker Compose misconfigurations.

Does adding declare(strict_types=1) to existing PHP files break anything?▼

Yes, adding strict_types to an existing file is a breaking change because silent type coercion that previously worked now throws TypeError. Only flag it on brand-new files where the entire diff consists of additions.

Why does type-hinting a BaseRepo override parameter cause a fatal error?▼

PHP enforces parameter contravariance on class overrides, so narrowing an untyped parent parameter like update($id) to int $id fails at class-load time. It is not caught by php -l, so it surfaces only in production.

When should logging an exception message be flagged as a security issue?▼

Logging $e->getMessage() server-side is safe when the HTTP response stays a fixed generic string. Flag it only when the raw exception reaches the response body, or when getTraceAsString() is logged, since traces include call arguments that can leak tokens and PII.

Related Skills

Explore More Software Engineering Skills→
onairmarconairmarc
2

php-code-review

Applies PHP/Laravel-aware checks to changed files and PRs for code review.

Community
Advanced
Disaster-TerminatorDisaster-Terminator
5

resolve-review-comment

Categorize pull request review comments and update their resolution statuses.

Community
Intermediate
majedsiefalnasrmajedsiefalnasr

db-migration-governance

Enforce MySQL migration naming, safety, and reversibility rules.

Community
Intermediate
hekivohekivo
13

superpowers-sage:wp-phpstan

Configure PHPStan static analysis for Sage and Acorn WordPress themes.

Official
Intermediate