padosoft-laravel-security-reviewlisted

Use this skill before committing or reviewing a change to a Laravel application that touches a model's fillable or guarded, a Blade template printing unescaped, raw SQL, a file upload, a route exempted from CSRF, a shell call, a redirect built from input, an id coming from the request, an audit trail, or an AI/LLM call — and whenever the user asks for a security review or an audit, or says an endpoint returns somebody else's data or an error shows SQL to the user. It runs ten checks with ready pre-screens plus ownership, audit integrity and error-leak rules. Do not use it for API-side (padosoft-api-security-review) or mobile (padosoft-mobile-security-review) work, nor for infrastructure hardening.
padosoft/skills · ★ 1 · Code & Development · score 80

Install: claude install-skill padosoft/skills

# Laravel security review Ten checks plus three rules whose cost is disproportionate to how easy they are to get wrong. Run them on the diff before committing, and on the PR during review. Output of a pre-screen is a **list of candidates to confirm or discard**, never an automatic bounce on a single grep match. --- ## The ten checks — `SEC-OWASP-001` ### 1. Mass assignment ```bash grep -rnE '->(create|fill|update)$(request\($->|.*->all)' --include='*.php' app/ ``` `$guarded = []` on a new model is an open door. Declare `$fillable` explicitly, and pass a **validated** array — `$request->validated()`, not `$request->all()`. A validated array is also the only one whose shape you can reason about later. ### 2. XSS through unescaped Blade ```bash grep -rnE '\{!! *\$' --include='*.blade.php' resources/ ``` `{!! $var !!}` prints raw. It is legitimate only for HTML you generated, never for anything that passed through user input or the database. If it must be user content, sanitise it at that point and say so in a comment. ### 3. Raw SQL with interpolation ```bash grep -rnE '(whereRaw|orderByRaw|selectRaw|havingRaw|DB::(raw|statement|select))\([^,)]*\$' --include='*.php' app/ ``` Bindings, always — including in `orderByRaw`, which people forget because it "is not a value". A column name or a sort direction goes through an **allow-list plus a ternary**, never a request string. ### 4. File upload Validate MIME **and** extension **and** size, store outside the web r