sc-lang-php

Name: sc-lang-php
Availability: InStock
Author: fatih

Detect PHP security anti-patterns and vulnerabilities in Laravel, WordPress, and general projects.

7|Updated Apr 9, 2026

Search Tags:#security #vulnerability #php #laravel #wordpress #deserialization

Ready to run

npx skills add https://github.com/fatihkan/badi --skill sc-lang-php-fatihkan

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sc-lang-php
Source: https://github.com/fatihkan/badi/tree/main/.claude/skills/security-check/sc-lang-php
Command: npx skills add https://github.com/fatihkan/badi --skill sc-lang-php-fatihkan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

PHP applications often suffer from security vulnerabilities due to deserialization, file inclusion risks, improper type handling, and misconfigurations. This skill detects PHP-specific security anti-patterns and misconfigurations in Laravel, WordPress, and generic PHP projects, helping teams harden code before deployment.

Core Features & Use Cases

Detects PHP-specific vulnerability patterns such as unserialize() gadgets, phar deserialization, LFI/RFI, and unsafe include/require usage.
Validates against the PHP Security Checklist (references/php-security-checklist.md) to surface common categories and provide remediation guidance.
Outputs structured findings with actionable remediation steps suitable for developers, reviewers, and security engineers.

Quick Start

Scan your PHP project with the sc-lang-php skill to surface PHP-specific security issues and receive actionable remediation guidance.

Frequently Asked Questions about sc-lang-php

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my PHP codebase for security vulnerabilities?▼

To scan a PHP codebase for security vulnerabilities, apply this skill to your Laravel, WordPress, or generic PHP project. It detects anti-patterns like unserialize() gadgets and file inclusion risks, then outputs structured findings with actionable remediation steps.

What PHP security anti-patterns can be detected in Laravel and WordPress?▼

Detectable PHP security anti-patterns in Laravel and WordPress include unserialize() deserialization chains, phar deserialization, LFI/RFI, and unsafe include/require usage. The scan validates against the PHP Security Checklist to surface these common vulnerability categories.

Does this PHP security scanner work with general PHP projects or only Laravel?▼

This PHP security scanner works with Laravel, WordPress, and general PHP projects. It identifies framework-specific issues alongside generic PHP vulnerabilities like insecure data handling and file inclusion risks, applying the PHP Security Checklist across all project types.

How do I fix unserialize() deserialization vulnerabilities in PHP?▼

To fix unserialize() deserialization vulnerabilities in PHP, review the structured findings generated by the scan. It identifies specific unsafe deserialization chains and provides actionable remediation guidance to help developers harden the code before deployment.

What is the best way to detect file inclusion risks in WordPress plugins?▼

The best way to detect file inclusion risks in WordPress plugins is running a targeted security scan. This process identifies LFI/RFI patterns and unsafe include/require usage, validating the codebase against the PHP Security Checklist to output actionable remediation steps.