Agent Skills: Php Expert

Php Expert

laravel best practices rules

When reviewing or writing code, apply these guidelines:

• Use Eloquent ORM instead of raw SQL queries when possible.
• Implement Repository pattern for data access layer.
• Use Laravel's built-in authentication and authorization features.
• Utilize Laravel's caching mechanisms for improved performance.
• Implement job queues for long-running tasks.
• Use Laravel's built-in testing tools (PHPUnit, Dusk) for unit and feature tests.
• Implement API versioning for public APIs.
• Use Laravel's localization features for multi-language support.
• Implement proper CSRF protection and security measures.
• Use Laravel Mix for asset compilation.
• Implement proper database indexing for improved query performance.
• Use Laravel's built-in pagination features.
• Implement proper error logging and monitoring.

laravel package coding standards

When reviewing or writing code, apply these guidelines:

• File names: Use kebab-case (e.g., my-class-file.php)
• Class and Enum names: Use PascalCase (e.g., MyClass)
• Method names: Use camelCase (e.g., myMethod)
• Variable and Properties names: Use snake_case (e.g., my_variable)
• Constants and Enum Cases names: Use SCREAMING_SNAKE_CASE (e.g., MY_CONSTANT)

laravel package development guidelines

When reviewing or writing code, apply these guidelines:

• Use PHP 8.3+ features where appropriate
• Follow Laravel conventions and best practices
• Utilize the spatie/laravel-package-tools boilerplate as a starting point
• Implement a default Pint configuration for code styling
• Prefer using helpers over facades when possible
• Focus on creating code that provides excellent developer experience (DX), better autocompletion, type safety, and comprehensive docblocks

laravel package structure

When reviewing or writing code, apply these guidelines:

• Outline the directory structure for the package
• Describe the purpose of each main directory and key files
• Explain how the package will be integrated

Consolidated Skills

This expert skill consolidates 1 individual skills:

• php-expert

Iron Laws

1. ALWAYS use parameterized queries or Eloquent ORM — raw SQL with string interpolation is the primary SQL injection vector in PHP; Eloquent's query builder parameterizes all values automatically.
2. NEVER store passwords with md5() or sha1() — these are fast hashes that GPUs crack in seconds; use password_hash() with PASSWORD_BCRYPT or PASSWORD_ARGON2ID for all password storage.
3. ALWAYS declare strict_types=1 at the top of every PHP file — without strict types, PHP silently coerces mismatched types, hiding bugs that only surface under unexpected inputs.
4. NEVER catch generic \Exception without re-throwing or specific handling — swallowing all exceptions masks errors and allows corrupt state to propagate silently through the application.
5. ALWAYS validate all user input at the controller boundary using Laravel's $request->validate() or Form Requests — never trust $_GET, $_POST, or $_FILES directly in business logic.

Anti-Patterns

| Anti-Pattern | Why It Fails | Correct Approach | | -------------------------------------------------- | -------------------------------------------------------------------- | ----------------------------------------------------------------------------- | | Raw SQL with string interpolation | Primary SQL injection vector; user input executed as SQL | Use Eloquent ORM or PDO parameterized queries for all database access | | Passwords stored with md5() or sha1() | Fast hashes cracked in seconds by GPU rainbow tables | Use password_hash() with PASSWORD_BCRYPT or PASSWORD_ARGON2ID | | Missing strict_types=1 | PHP silently coerces types; bugs hide until unexpected inputs arrive | Declare <?php declare(strict_types=1); at the top of every PHP file | | Catching generic \Exception silently | Masks errors; corrupt state propagates; impossible to debug | Catch specific exceptions; log with context; re-throw or handle explicitly | | Directly using $_GET/$_POST without validation | Enables injection, XSS, and business logic bypass | Validate at controller boundary using $request->validate() or Form Requests |

Memory Protocol (MANDATORY)

Before starting:

cat .claude/context/memory/learnings.md

After completing: Record any new patterns or exceptions discovered.

ASSUME INTERRUPTION: Your context may reset. If it's not in memory, it didn't happen.