- What does the llm/skills Composer package actually do?
- It is a Composer plugin that downloads AI Skills from your Composer and vendor packages, and from arbitrary Git repositories added with skills:add, then keeps them synced into a project-local directory that defaults to .agents/skills/. A skill is simply a directory containing a SKILL.md file plus any auxiliary files such as templates, examples or fixtures, and coding agents read that file for project-specific instructions. Skills are assembled on demand or automatically during composer install and composer update.
- How do I install llm/skills in a Laravel project?
- Run composer require --dev llm/skills and answer y when Composer prompts to allow the plugin. For non-interactive setups, pre-allow it by adding llm/skills under config.allow-plugins in your composer.json. After that, bootstrap the project configuration file, skills.json, which controls which skills are synced and where. Installing as a dev dependency makes sense because skills are developer tooling rather than runtime application code.
- Does llm/skills work with Laravel 10, 11 and 12?
- The plugin is framework-agnostic and hooks into Composer rather than Laravel internals, so it does not depend on a specific Laravel version. It works in any Laravel application running Composer 2 on a PHP version that satisfies the package constraint listed on Packagist and in its composer.json. Because it registers no service provider and calls no version-specific Laravel APIs, upgrades between Laravel releases should not affect it.
- How are skills discovered inside vendor packages?
- Skills are auto-discovered by their SKILL.md files wherever they live, so a package does not even have to declare anything in its composer.json to expose one. The directory name is the skill's identity, so two packages shipping a directory with the same name would collide. You can also point the plugin at specific sources through skills.json when you want tighter control than auto-discovery gives you.
- Can I pull skills from GitHub or GitLab without publishing a Composer package?
- Yes. The skills:add command registers arbitrary Git repositories, including GitHub and GitLab, as skill sources alongside your Composer packages. That is useful for internal team conventions or third-party skills that are not published on Packagist. Once added, those skills are synced into your project the same way package-provided skills are.
- Where are skills synced and how do I configure it?
- By default skills land in .agents/skills/ inside the consuming project, and the location plus sync behaviour is controlled from skills.json. You can set auto-sync to false to stop syncing during composer install and update, and keep the directory tool-agnostic so IDE plugins or CLI tools can read it. Aliases such as .claude/skills for Claude Code or Cursor can point agent tools at the same content.
- Is llm/skills safe to use, and what are the security concerns?
- Skills are instruction files consumed by AI agents, so the trust model matters: a malicious skill could inject prompts or steer an agent into unwanted actions. Audit what is being pulled in with composer skills:show --verbose, prefer known donor packages, and consider enforcing trusted-replace in production. Keep the dependency in require-dev so it never ships to production runtime, and review skill changes the way you review code.
- Will auto-syncing skills slow down composer install in CI?
- Auto-syncing on every composer install or update adds work to the build, and the cost grows with the number of skills being assembled. For CI you can disable it by setting auto-sync to false in skills.json and run the sync as an explicit, cached step instead. Using a dry-run option to preview changes before syncing also helps catch unexpected diffs early.
- Do the generated skill directories cause Git or Windows problems?
- Synced directories and tool aliases such as .claude/skills can show up as untracked files or create merge conflicts if they are not ignored, so add them to .gitignore where appropriate. If your setup relies on junctions or symlinks, note that these behave differently on Windows than on POSIX systems. Test on the environments your team actually uses before rolling the plugin out broadly.
- Can my own Laravel package ship AI skills to consumers?
- Yes. Because skills are auto-discovered from SKILL.md files, a Laravel package can include a skill directory and consumers receive it automatically on composer install with no extra configuration. This lets package authors ship conventions, recipes and refactoring guidance alongside their code. Pair it with sensible content so the skill stays useful as the package evolves.