mjg/apps
Claude Code skill · v0.1

Laravel Audit

A deterministic, dependency-free scanner packaged as a Claude Code skill. Point Claude at any Laravel 9/10/11/12 repo and get a scored HTML report in seconds.

Buy on Gumroad — $39One-time purchase · Free updates · Commercial license
  • 13 rules: security, performance, AI-slop, deploy
  • File:line precision + plain-English fixes
  • Standalone HTML → print-to-PDF
  • White-label with your own brand + CTA
  • Zero Composer deps — PHP 8.1+ only
  • Installs in 3 steps
Sample reportmonica-report
0/ 100F

1,656 files scanned · 14 findings

0
Crit
9
High
2
Med
3
Low
APP_DEBUG enabled
.env:4
Potential N+1 inside foreach
app/Jobs/SyncImapFolderJob.php:101

What it catches, across four categories

Security (5)

Mass assignment, raw SQL interpolation, hardcoded secrets, debug leftovers, APP_DEBUG in prod.

Performance (3)

Potential N+1 inside loops, unindexed foreign keys, synchronous Mail::send.

AI-slop (2)

High TODO/FIXME density and clusters of stub functions that never got filled in.

Deploy hygiene (3)

Missing composer.lock, lock older than composer.json, PHP version unpinned.

The full rule set (v0.1)

Every finding comes with file:line precision and a one-line fix.

RuleTitleSeverity
SEC-001APP_DEBUG enabled in .envcritical
SEC-002Unbounded mass assignment ($guarded = [])high
SEC-003Raw SQL with variable interpolationcritical
SEC-004Hardcoded API keys or secrets in sourcecritical
SEC-005dd() / dump() / var_dump() left in codemedium
PERF-001Potential N+1 query inside foreachhigh
PERF-002Foreign key column without indexmedium
PERF-003Synchronous Mail::send (not queued)medium
SLOP-001High TODO / FIXME density in a filelow
SLOP-002Multiple stub functions with empty returnslow
DEPLOY-001composer.lock missinghigh
DEPLOY-002composer.lock older than composer.jsonmedium
DEPLOY-003PHP version not constrained in composer.jsonlow

Installs in 3 steps

  1. 1
    Download & unzip
    Your Gumroad purchase gives you a single zip file with the skill.
  2. 2
    Move into your Claude skills directory
    mv laravel-audit ~/.claude/skills/
  3. 3
    Restart Claude Code
    The skill auto-registers. Ask Claude to audit any Laravel app.
Requires PHP 8.1+ (any install: Herd, Valet, Homebrew). Zero Composer dependencies.

White-label the report

Add your own brand, URL, and call-to-action to every report — ideal for consultants handing audits to clients.

{
  "brand_name": "Acme Code Reviews",
  "brand_url":  "https://acme.example.com",
  "footer_cta": "Want the full human-reviewed audit? Book a call."
}

Drop a config.json next to SKILL.md and every report carries your brand.

FAQ

Ready to audit your Laravel app?

One $39 purchase. Unlimited projects. Free v0.x updates.

Buy on Gumroad

Want a human-reviewed audit with custom fixes? Book a call.