README

Sander Muller's personal Composer-distributed catalog of AI agent skills for PHP projects and Composer packages. Adopt it if your preferences align with Sander's, or use it as a template for your own.

No runtime code — pure Markdown. A sync engine (sandermuller/boost-core or laravel/boost) reads the skills and always-on guidelines below and writes them into every AI agent directory you have configured: Claude Code, Cursor, Copilot, Codex, Gemini, and the rest.

Documentation: https://sandermuller.github.io/boost-core/packages/boost-skills/

Install

Install the catalog beside the family package for your role — the picker settles which in two questions:

composer require --dev sandermuller/boost-skills sandermuller/package-boost-php

Then allowlist the vendor — a catalog ships nothing until you name it:

return BoostConfig::configure()
    ->withAgents([Agent::CLAUDE_CODE, Agent::COPILOT, Agent::CODEX])
    ->withAllowedVendors([
        'sandermuller/boost-skills',
        'sandermuller/package-boost-php',
    ])
    ->withTags(['php', 'github']);

vendor/bin/boost install   # the picker offers this vendor; select it
vendor/bin/boost sync

vendor/bin/boost tags lists what a further tag would unlock.

Under laravel/boost instead, follow its setup and include this package in what it syncs. Tag filtering and Project Conventions slots are inert there; skills carry visible defaults, so a slot still reads sensibly.

Documentation

Topic	Page
Adopting the catalog, editing a skill	Overview
The same inventory, rendered	Skill catalog
Where skills come from, and which gates apply	Skill sources
How tags and `boost-requires` work	Tags and dependencies
The conventions slot mechanism	Project Conventions
Shipping scripts beside a skill	Skill assets
Re-syncing on `composer install`	Automating the sync

Skills

The inventory below is the catalog's contract — CI checks it against the shipped skills and their tags, so it stays exact. The same list, rendered, is on the skill catalog page.

35 skills — click to expand the inventory

Skill	What it does	Tags
`ai-guidelines`	Create and maintain AI skills and guideline files (`.ai/`, `CLAUDE.md`, `AGENTS.md`).	—
`autoresearch`	Autonomous performance loop: benchmark, change code, then keep or revert by measured result.	`php`
`backend-quality`	Two-tier PHP quality gate: Pint + related tests on every change, PHPStan + full suite on completion.	`php`
`bug-fixing`	Test-driven bug workflow: reproduce with a failing test, then fix it.	—
`clarify`	Turn a fuzzy ask into sharp, fact-checked intent — reduce ambiguity, sharpen terms, surface assumptions. Shared core of `interview` and `promptimize`.	—
`clean-specs`	Command-only (`/clean-specs`): remove spec files whose work is fully implemented and proven on the base branch, keeping only live work.	—
`code-review`	Review recent changes across functionality, code quality, security, and tests.	—
`codex-review`	Request an independent review from the OpenAI Codex CLI, apply the warranted fixes, re-review until clean.	—
`deploying-laravel-cloud`	Deploy and manage Laravel apps on Laravel Cloud via the `cloud` CLI — environments, databases, domains, billing.	`laravel-cloud` `hosting`
`eloquent-models`	Create and maintain Eloquent models with column/relation constants, comprehensive docblocks, and FK constants.	`laravel`
`evaluate`	Self-review a full implementation and fix the issues it surfaces.	—
`eye-verification`	Command-only (`/eye-verification`): mandatory browser pass over a frontend change — resolve the testables, drive each one, publish the proof screenshots.	`frontend`
`final-verification-review`	Closeout verdict: run the full evaluate loop, dry-run the closeout preflight (PR flow or no-PR commit/release), report READY / NOT READY.	`github`
`frontend-quality`	Frontend quality gate: type-checking, linting, and the JS test suite; browser eye-verify for UI changes, with a shipped harness.	`frontend`
`github-issue-updates`	Append a user-facing description and QA testables to a GitHub issue after a feature ships.	`github-issues`
`humanizer`	Remove signs of AI-generated writing so text reads as natural and human.	—
`implement-spec`	Implement a specification file phase by phase with progress tracking.	—
`interview`	Adversarially grill out a complex feature's requirements — code-first, assumptions-audited — before writing its spec.	—
`jira-create`	Create a Jira issue with a well-formed, user-facing description.	`jira`
`jira-rework`	Research a Jira issue sent back for rework, then propose fix options.	`jira` `github`
`jira-updates`	Update a Jira issue after its PR is created; post Blocked-by-Question comments.	`jira`
`migration-squash`	Create or review a Laravel migration squash safely — pre-flight the dump, then a checklist catching incomplete, contaminated, or data-losing baselines.	`laravel`
`php-generics`	Docblock generics and shapes: name a repeated `array{...}`, bind a generic base, type a class name.	`php`
`pr-review-feedback`	Apply PR review comments, evaluating each critically before acting.	`github`
`pre-release`	Pre-push gauntlet: Rector, Pint, full test suite, PHPStan, and a doc-staleness audit (README, docs site, `.ai/`).	`php` `github` `release-automation`
`promptimize`	Turn a rough prompt into one optimized, model-agnostic prompt — close gaps, fact-check against the codebase, rewrite, return only the prompt.	—
`pull-requests`	Create and manage your own GitHub PRs via `gh`: write the description, verify, route by risk.	`github`
`readme`	Author and maintain a concise README for a Composer package — stub, comprehensive, or docs-site shape, a problem-first opening, length budgets, curated coverage, voice, staleness/verbosity + docs index/link audits.	`release-automation`
`release-notes`	Draft GitHub release bodies for Composer packages — structure, length budget, voice, breaking-change callouts, what to omit.	`release-automation`
`resolve-conflicts`	Resolve git merge conflicts without dropping functionality from either side.	—
`simplify-shape`	Judge whether a change carries its values in the right type: enum, form request, DTO, query-builder method.	`php`
`test-value`	Judge the tests a change touched: delete what proves nothing, cover what nothing tests.	—
`test-writing`	Write specific, descriptively named tests that follow Arrange-Act-Assert.	—
`upgrading`	Canonical structure for UPGRADING.md in a Composer package — when to maintain one, what to put in it.	`release-automation`
`ux-review`	Weigh UX/UI options for a new feature, recommend an approach, and document the decision.	—
`write-spec`	Write implementation-ready specification files with progress-trackable phases.	—

Tag	Meaning	Owner
`boost-extension`	opt-in — extending boost-core (custom skills + FileEmitters)	`package-boost-php`
`database`	project has a database	`boost-skills`
`frontend`	frontend toolchain — type-checking, linting, JS tests	`boost-skills`
`github`	hosted on GitHub	`boost-skills`
`github-issues`	issue tracking in GitHub Issues	`boost-skills`
`hosting`	project deploys to a hosted platform (parent of platform-specific tags)	`boost-skills`
`jira`	issue tracking in Jira	`boost-skills`
`laravel`	project uses the Laravel framework (Eloquent, service providers, etc.)	`boost-skills`
`laravel-cloud`	app deploys to Laravel Cloud (pair with `hosting`)	`boost-skills`
`php`	PHP toolchain — Pint, PHPStan, Rector	`boost-skills`
`release-automation`	opt-in — release flow content: README authoring, release notes, UPGRADING, CI changelog automation	`boost-skills`, `package-boost-php`
`single-issue-scope`	opt-in — enforce single-issue PR/branch/session discipline	`boost-skills`
`voice`	opt-in — route every writing surface to one voice rule (ASD-STE100 Simplified Technical English)	`boost-skills`

Guidelines

Short Markdown files of project-wide convention, folded into CLAUDE.md / AGENTS.md. Unlike skills they are always active — no on-demand activation. They are tagged like skills, but from a sidecar .boost-tags.yaml manifest, since a guideline file stays frontmatter-free for laravel/boost compatibility.

A second sidecar, .boost-user-scope.yaml, lists the guidelines that hold in any repository. boost sync --scope=user --all publishes those to your agent directories, so they apply on the machine rather than in one project (needs boost-core >= 1.10.0). The two sidecars answer different questions and do not interact: tags pick which projects a guideline reaches, and the user-scope list picks whether it ships outside a project at all. voice is in both. A user-scope guideline must render token-free, because user scope has no boost.php to resolve a conventions token against.

10 guidelines — click to expand

Guideline	What it covers	Tags
`ask-user-question`	Avoid first/second-person pronouns in AskUserQuestion payloads — name the actor instead.	—
`database-safety`	Never run destructive database commands; treat the test database as test-runner-owned.	`database`
`javascript`	JS/TS control-structure style — always use curly braces, no single-line conditionals.	`frontend`
`migrations`	Self-contained migration files; append columns instead of positioning them mid-table.	`database`
`phpstan-fixing`	Fixing a PHPStan error — write a failing test first when it maps to a runtime bug.	`php`
`signed-commits`	Never fall back to an unsigned commit when signing is enabled — surface the failure to fix it instead.	—
`single-issue-scope`	Keep each session, branch, and PR focused on exactly one issue.	`single-issue-scope` (opt-in)
`task-scope`	Keep the change to what the task asks, pick one reading of an ambiguous ask, and edit in place.	—
`verification-before-completion`	Run the verification command and read its output before claiming work is done, and say what you did not verify.	—
`voice`	One voice rule per writing surface — a routing table, the Simplified Technical English rules, and how much to write.	`voice` (opt-in)

Subagents

Claude Code subagent definitions this package ships. A subagent runs in its own context, which is the point: an adversarial pass judges a change as code somebody else wrote, and the same rules applied by the author who wrote it are a weaker check. boost-core emits them to .claude/agents/boost/<vendor>__<package>/, a subtree it owns; hand-written definitions at the top of .claude/agents/ are untouched. Targets with no subagent concept receive nothing.

Subagent	What it does	Tags
`simplification-auditor`	Audit a change for code that does not need to exist, and return a ledger accounting for every unit it added.	—
`tech-lead-reviewer`	Review the approach one altitude above the line: design size, value types, placement, one-way doors.	—
`test-coverage-auditor`	Find the untested failure paths and the assertions that pass whatever the code does.	—

boost-core 1.9.0 added the subagent channel; an older engine ignores the directory entirely, so this costs a consumer on an earlier version nothing.

Already wrote one of these yourself? Claude Code resolves a dispatch by the frontmatter name, not by path, so your .claude/agents/tech-lead-reviewer.md and the shipped one are two files claiming one name — and which one loads is filesystem read order. Delete or rename your copy when you adopt the shipped version; boost sync warns about the overlap until you do. A skill that dispatches one should say what its inline fallback loses — see the ai-guidelines skill.

Editing skills and guidelines

Skills are resources/boost/skills/<name>/SKILL.md with name + description frontmatter. Guidelines are resources/boost/guidelines/<name>.md with no frontmatter — they must open at a heading to render under both engines.

Edit them here, never in a consuming project's synced copy — boost-core overwrites that on the next sync. The ai-guidelines skill carries the frontmatter contract.

Changelog

See CHANGELOG.md for release history.

Security

Found a vulnerability? Email github@scode.nl rather than opening a public issue. See SECURITY.md for the disclosure policy.

Skill scanners report findings here

Static skill scanners such as SkillSpector flag this package. The findings are false positives. Three patterns cause them:

HTML comments read as prompt injection. Every  token is a boost-core conventions placeholder that the sync resolves. So are the  and  anchors. A scanner cannot tell them from a hidden instruction.
Anti-pattern prose read as an instruction. A skill that lists "without asking" or "skip verification" as a thing not to do matches the same string as a skill that tells an agent to do it.
Documented shell commands read as tool misuse. The autoresearch skill prints git reset --hard HEAD~1 because its loop commits before it measures, so a rejected experiment reverts in one step.

Do not add a scanner baseline file to this repository. A baseline written by the package author suppresses the findings in a consumer's own scan, which is why SkillSpector ignores a discovered baseline until the consumer opts in.

Credits

Sander Muller

License

MIT. See LICENSE.

sandermuller / boost-skills

Package info

Security

Statistics

README

Install

Documentation

Skills

Tags

Guidelines

Subagents

Editing skills and guidelines

Changelog

Security

Skill scanners report findings here

Credits

License