laravel-security-audit
Audit Laravel Security Risks
Laravel applications can hide authorization, validation, and deployment weaknesses. This skill guides Claude, Codex, and Claude Code through structured security reviews.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "laravel-security-audit" from https://skillstore.io/skills/sickn33-laravel-security-audit.md and its manifest at https://skillstore.io/api/skills/sickn33-laravel-security-audit/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "laravel-security-audit". A controller returns an order by user-supplied ID without ownership checks.
Expected outcome:
- High risk IDOR because authenticated users may access other users orders.
- Add a policy check or scope the query to the authenticated user.
- Include an authorization test for cross-user access attempts.
Using "laravel-security-audit". A production configuration summary shows debug enabled and broad CORS access.
Expected outcome:
- High risk deployment misconfiguration because debug output may expose sensitive internals.
- Disable debug in production and restrict CORS origins to trusted clients.
- Verify HTTPS and trusted proxy settings before release.
Using "laravel-security-audit". A file upload flow accepts images and stores them on a public disk.
Expected outcome:
- Medium risk if MIME, extension, size, and executable content checks are incomplete.
- Store uploads outside executable paths and serve them through controlled responses.
- Add validation rules and tests for invalid file types.
Security Audit
SafeThe static alerts are false positives caused by Laravel security checklist language and a Markdown code fence. The skill does not request secrets, run commands, or perform network reconnaissance. No semantic evidence of prompt injection, exfiltration intent, or unsafe execution was found.
Risk Factors
⚙️ External commands (1)
🌐 Network access (1)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-laravel-security-audit/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-laravel-security-audit?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-laravel-security-audit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-laravel-security-audit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-laravel-security-audit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). laravel-security-audit security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-laravel-security-audit/audits/4BibTeX citation
@techreport{sickn33-sickn33-laravel-security-audit-2026,
author = {sickn33},
title = {laravel-security-audit security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-laravel-security-audit/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "laravel-security-audit security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-laravel-security-audit/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-laravel-security-audit:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Review Pull Requests
Find security regressions in Laravel controllers, routes, requests, policies, and models before merge.
Prepare Release Hardening
Check deployment settings, debug exposure, CORS, HTTPS, trusted proxies, and environment file risks.
Assess API Risk
Evaluate authentication, throttling, sensitive fields, pagination limits, and authorization coverage for Laravel APIs.
Try These Prompts
Review this Laravel code for validation, authorization, and data exposure issues. Classify each issue and suggest Laravel-native fixes.
Audit these Laravel API routes and controllers for authentication, throttling, IDOR, sensitive fields, and unsafe request handling.
Assess this Laravel file upload flow for MIME checks, extension checks, storage location, executable upload risk, and size limits.
Audit this Laravel release against OWASP risks, deployment settings, authentication, authorization, CORS, debug state, and .env exposure.
Best Practices
- Provide routes, controllers, FormRequests, policies, middleware, models, and relevant configuration together.
- State the environment, user roles, and expected access rules before requesting severity ratings.
- Ask for exploit scenario, impact, and Laravel-native fix for each confirmed issue.
Avoid
- Do not use it to probe live third-party systems or bypass authorization.
- Do not paste secrets, tokens, passwords, or full environment file values.
- Do not treat the output as a complete penetration test or compliance certification.
Frequently Asked Questions
What Laravel versions does this skill target?
Can it review authentication and authorization code?
Does it perform live security testing?
Should I paste my .env file?
Can it provide fixed examples?
Is the audit output final security approval?
Developer Details
Author
sickn33License
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/laravel-security-auditRef
816c62b2546ddb1c6a0453e7c781b5e095117819
Maintenance freshness
7/18/2026
Usage
12 downloads · 106 views
File structure
📄 SKILL.md