Best AI Agent Skills for PHP and Laravel Developers (2026)
PHP spans modern Laravel and legacy WordPress, and agents mix the two. These SKILL.md skills encode Eloquent patterns, test conventions, and PSR standards.
PHP spans modern Laravel and legacy WordPress, and agents mix the two. These SKILL.md skills encode Eloquent patterns, test conventions, and PSR standards.
Quick Answer: The best skills for PHP developers cover Laravel Eloquent query patterns and N+1 prevention, Pest and PHPUnit test generation, PSR-12 formatting and modern PHP 8 syntax, and WordPress-specific security and hook conventions. All use the SKILL.md format and work across Claude Code, OpenClaw, Codex CLI, Cursor, and other compatible agents. Browse them at agensi.io/skills.
Why generic skills fall short for PHP
PHP has the widest gap between what an agent has seen and what your project is.
Training data spans PHP 5 tutorials, WordPress plugin code from 2014, and modern Laravel 11 with typed properties and enums. Without direction, an agent picks a plausible average of all of it, which is idiomatic for nothing.
The specifics that need stating: which PHP version, because 8.0 through 8.4 added constructor promotion, enums, readonly properties, and typed class constants. Whether it's Laravel, Symfony, plain PHP, or WordPress. Whether tests are PHPUnit or Pest, which have very different syntax. Whether static analysis runs — PHPStan or Psalm, and at what level.
Recommended skills
migration-auditor
by Samuel Rose
Catches dangerous database migrations before they hit production. Reviews schema…
technical-seo-auditor
by Julian
Audit web pages against 13 technical SEO factors to generate structured complian…
clone-site-to-elementor
by Shai Ben - Dor · 105
Clone any webpage into fully editable native Elementor Pro widgets with pixel-pe…
Laravel and Eloquent
Eloquent is where generated PHP most often works in development and falls over under load.
The N+1 query problem is the main one. An agent writes a loop over $posts accessing $post->author->name and generates one query per row. A skill that requires with() eager loading for any relationship accessed in a loop prevents it.
Other Laravel conventions worth encoding: form requests for validation rather than inline $request->validate(), whether business logic lives in controllers, services, or actions, resource classes for API responses rather than returning models directly, and whether the project uses repositories or queries Eloquent directly from services.
Database access rules matter here. Whether raw DB:: queries are permitted, and whether migrations are ever edited after being run, are project decisions an agent cannot guess.
Browse database engineering skills on Agensi.
Testing skills
Pest and PHPUnit are both current and their syntax is completely different.
PHPUnit uses classes extending TestCase with test-prefixed methods or @test annotations. Pest uses closures: it('does something', function () { ... });. An agent generating PHPUnit-style classes into a Pest suite produces something that runs but reads as foreign.
A PHP testing skill should detect the framework from composer.json, know whether the project uses Laravel's RefreshDatabase trait or an in-memory SQLite database, and follow the existing factory conventions rather than constructing models by hand.
Browse testing and QA skills on Agensi.
Code review for PHP
code-reviewer (764 installs, free) is the most installed skill on Agensi and covers general bugs, security, and error handling across languages.
The PHP-specific criteria worth adding:
SQL injection. Any string-concatenated query is a finding. Prepared statements or the query builder, always.
Mass assignment. Laravel models need $fillable or $guarded set deliberately, and Model::create($request->all()) without either is a vulnerability.
Type declarations. Whether the project uses declare(strict_types=1) and typed properties, and whether new code must match.
Output escaping. In Blade, {{ }} escapes and {!! !!} does not. Every use of the latter needs justification.
PSR standards and modern PHP
PSR-12 is the current formatting standard and PSR-4 governs autoloading. A skill that states the standard and the tooling — Laravel Pint, PHP CS Fixer, or PHP_CodeSniffer — stops the agent formatting to a different convention than the rest of the repo.
Modern syntax is worth stating explicitly, because the agent will default to older forms. Constructor property promotion, enums instead of class constants, match instead of switch, named arguments, and nullsafe operators are all available on PHP 8 and all absent from most training examples.
WordPress-specific skills
WordPress is a distinct discipline within PHP and the conventions barely overlap with Laravel.
wordpress-hardening-security-audit audits WordPress installations for security issues on Agensi.
A WordPress skill should encode: nonce verification on every form and AJAX handler, capability checks with current_user_can() before any privileged action, sanitisation on input and escaping on output using the WordPress functions rather than raw PHP, and $wpdb->prepare() for every query.
Hook conventions matter too — whether the project uses actions and filters properly rather than modifying core or theme files directly.
Installing these skills
~/.claude/skills/
├── code-reviewer/
│ └── SKILL.md
├── wordpress-hardening-security-audit/
│ └── SKILL.md
Claude Code reads from ~/.claude/skills/, OpenClaw from ~/.openclaw/skills/, Codex CLI from ~/.codex/skills/. Skills load at session start, so restart after adding one.
Full walkthrough: How to Install Skills in Claude Code.
Browse PHP-compatible skills for any AI coding agent on Agensi.