- What is sandermuller/boost-skills and what does it actually do?
- It is a Composer-distributed catalog of AI agent skills for PHP and Laravel projects, maintained by Sander Muller. The package ships curated Markdown: generic workflow skills such as code review, bug fixing, spec-driven implementation, release checklists, Jira and deployment, plus tag-gated framework extras and always-on guidelines. A sync engine writes those files into the AI agent directories you have configured, including Claude Code, Cursor, Copilot, Codex and Gemini. It registers no PHP classes, service providers or routes in your application.
- How do I install boost-skills in a Laravel project?
- Require it as a dev dependency alongside the family package that matches your project, for example composer require --dev sandermuller/boost-skills sandermuller/package-boost-php. Then allowlist the vendor in your BoostConfig using withAllowedVendors(), select agents with withAgents() and filter content with withTags(). Finish with vendor/bin/boost install and vendor/bin/boost sync. A catalog ships nothing until you explicitly name it in the allowlist, so skipping that step leaves your agent directories untouched.
- Do I need laravel/boost or boost-core to use this package?
- Yes. The catalog is inert on its own because it contains only Markdown definitions; a sync engine such as sandermuller/boost-core or laravel/boost reads the skills and writes them into each configured agent directory. Install it next to the family package for your role and allowlist the vendor. Without a sync engine plus an allowlist entry, nothing is copied into your project.
- Which AI agents does boost-skills support?
- Whatever your sync engine can write to, which currently covers Claude Code, Cursor, Copilot, Codex and Gemini. You choose the targets per project through withAgents() in the boost configuration, for example withAgent entries for CLAUDE_CODE, COPILOT and CODEX. Because skills are plain Markdown, adding another agent is a matter of the sync engine supporting that directory layout.
- Does boost-skills add runtime code or dependencies to my Laravel app?
- No PHP code is executed by your application; the package is Markdown-first and safe as a dev dependency with zero runtime footprint. One caveat: as of the 2.52.x line it also ships a resolve-conflicts workflow backed by a shell script, dangling-symbols.sh, which runs in your shell or CI rather than inside Laravel. That introduces a bash/POSIX dependency for the conflict-resolution feature, which you can adopt or ignore independently of the skills themselves.
- How do tag-gated skills work and how do I see what is filtered out?
- Tag-gated content is only synced when the corresponding tag is enabled, so calling withTags(['php', 'github']) pulls in the PHP and GitHub flavored extras while leaving other framework content out. Run vendor/bin/boost tags to list which tagged content is currently filtered, which makes it easy to audit what your agents actually receive. This lets you adopt the catalog selectively instead of importing the whole set.
- Which Laravel and PHP versions does boost-skills support?
- The package itself contains no Laravel-version-specific PHP code, so real compatibility is governed by the sync engine you pair it with, laravel/boost or sandermuller/boost-core, and by Composer resolving it as a dev dependency. Check that engine's current requirements for the Laravel and PHP versions running on your project. Many skills are framework-agnostic by default, while Laravel-tagged skills such as deployment and testing should be reviewed for relevance to your setup.
- Can I fork boost-skills to build my own team skill catalog?
- Yes, the package is explicitly positioned as a template for your own catalog. Fork the repository, curate your own skills, guidelines and tag assignments, and publish it under your own vendor name. Install it alongside the same sync engine family and allowlist your vendor as usual. This is the recommended path if you want internal conventions, deployment checklists and review workflows encoded without inheriting someone else's personal preferences.
- How often is boost-skills released and should I pin the version?
- Very frequently: the package moved from 2.15.0 to 2.52.1 in roughly two months, on the order of 37 minor releases, with behavioral fixes landing in patch versions such as 2.52.1 correcting a 2.52.0 regression. Pin an exact version in composer.json and treat upgrades as reviewable changes instead of routine composer update churn. Read the release notes before bumping, particularly for the conflict-resolution tooling where behavior has changed in patch releases.
- Is the dangling-symbols.sh conflict-resolution script safe to adopt?
- The resolve-conflicts workflow runs dangling-symbols.sh, a bash script that scans declarations versus imports by line and regex to find symbols left dangling after a merge conflict is resolved. That parsing surface is inherently brittle around block comments, generics, multi-line signatures and mixed PHP plus JS/TS imports, and 2.52.1 fixed a false clean-sweep where a declaration following a closed block comment was dropped entirely. Validate its output against your own codebase before trusting it in CI, verify the script provenance against the release notes, and remember the tooling decision is separable from the skills themselves if you want to avoid shell execution or POSIX-only tooling on Windows-native fleets.