Skills Laravel Package

Product Decisions This Supports

• AI Agent Integration Roadmap: Enables modular, dependency-managed AI skill distribution for coding agents (e.g., Claude, Cursor, Aider). As of 1.15.0, the tool ships standalone binaries for Linux, macOS, and Windows, removing the PHP runtime prerequisite from the adoption path and widening the addressable surface to every engineering team, not just PHP shops.
• Build vs. Buy: Avoids reinventing skill distribution infrastructure; leverages Composer’s existing ecosystem for dependency management and now offers a prebuilt CLI distribution channel (no compiler toolchain, no PHP install) — further reducing the internal build case.
• Use Cases:
  • Team Onboarding: Standardize AI skills across engineering teams via Composer packages; one-command install on any OS.
  • Agent Agnosticism: Share skills across multiple agents (e.g., .agents/skills → .claude/skills).
  • Security: Explicit trust controls mitigate prompt-injection risks from untrusted packages.
  • DevOps Integration: Auto-sync skills on composer install aligns with CI/CD pipelines; standalone binaries make the same workflow viable in polyglot CI runners (Node, Go, Python, JVM images) without provisioning PHP.
  • Cross-Platform Fleets: Mixed Windows/macOS/Linux developer populations get parity — relevant for enterprises with heterogeneous dev images and for Windows-heavy .NET or game-dev orgs.

When to Consider This Package

• Adopt if:

  • Your team uses multiple coding agents (e.g., Claude, Cursor, Aider) and needs shared skill repositories.
  • You want Composer-managed AI skills (versioned, dependency-tracked) instead of manual file copies.
  • Security is critical: Explicit trust controls are required for untrusted environments.
  • You’re building a platform for AI-assisted development and need agent-agnostic skill distribution.
  • Your stack is not PHP-centric but you still want Composer-style skill distribution — the 1.15.0 standalone binaries let non-PHP teams adopt the sync mechanism without installing PHP locally, though they still need Composer (or a PHP-capable CI job) to resolve skill packages.
  • You support Windows developers: prior to 1.15.0, symlink/junction behavior on Windows was a friction point; the Windows binary now makes this a supported first-class target rather than a caveat.
  • You need hermetic, offline-capable installs: vendored binaries can be baked into base images, removing network/runtime variability from skill setup.

• Look elsewhere if:

  • Your use case is single-agent (e.g., only Claude) and doesn’t need cross-agent compatibility.
  • You prefer centralized skill hosting (e.g., GitHub repos, private registries) over Composer.
  • You need dynamic skill loading (e.g., runtime updates without a re-install/re-sync step) — the standalone binary changes how the tool runs, not the install-time sync model.
  • You require fully managed/SaaS distribution with no client-side artifact to version, sign, and patch — shipping binaries introduces a new supply-chain surface (binary provenance, checksum verification, update cadence) your security team must own.
  • Your organization has no Composer usage anywhere in the supply chain and no appetite to introduce it solely for skills.

How to Pitch It (Stakeholders)

For Executives: "This package lets us distribute AI skills (coding guidelines, templates, review checklists) as Composer dependencies—just like any other library. Teams auto-sync skills on install, cutting onboarding time and keeping behavior consistent across agents like Claude or Cursor. The 1.15.0 release ships standalone binaries for Linux, macOS, and Windows, which means we can roll this out company-wide without asking every developer to install PHP. It’s secure by default (explicit trust controls), versioned, cross-platform, and fits our existing stack. Think of it as ‘npm for AI skills’—now with a one-download installer for every laptop in the org."

For Engineering: *"llm/skills solves the ‘how do we share AI skills across agents?’ problem by treating them as Composer packages. Key benefits:

• One source of truth: Skills live in .agents/skills/ and are mirrored to agent-specific paths (e.g., .claude/skills) via symlinks/junctions.
• Security: Only trusted packages (explicit or via composer.json deps) are synced; malicious payloads are blocked.
• DevOps-friendly: Auto-syncs on composer install (configurable) and works in CI/CD.
• Agent-agnostic: Works with Claude, Cursor, Aider, etc., without duplication.
• New in 1.15.0 — standalone binaries: Linux, macOS, and Windows builds mean you can run the sync tool in any CI image or on any developer machine without a PHP toolchain. Pin the binary version alongside your Composer lockfile so tool and skill resolution stay in lockstep. Example: Add composer require llm/skills to your project, and skills from packages like acme/skills-refactor auto-populate into .agents/skills/refactor/ — reproducible on Windows laptops and Linux CI alike."*

For Security/Compliance: *"The package enforces strict trust controls: skills are only copied from:

1. Direct Composer dependencies (require/require-dev),
2. Explicitly trusted packages (configured in skills.json), or
3. CLI-whitelisted packages. Malformed or untrusted packages are skipped with warnings. Symlinks/junctions ensure no duplicate files, and the target directory is configurable for isolation.

New consideration for 1.15.0: the release introduces prebuilt binaries, which expands the supply-chain review scope. Recommend (a) pinning binaries to an explicit version and verifying published checksums/signatures, (b) hosting the approved binary in an internal artifact mirror rather than pulling from release URLs at build time, and (c) treating binary upgrades as a reviewed change alongside Composer dependency updates. Trust semantics for skills are unchanged; only the delivery vehicle for the tool itself is new."*