I Built a Laravel Package So Your AI Agents Can Install "Skills" Like Plugins

shadman Shaikh — Wed, 05 Aug 2026 08:54:14 +0000

Your AI Agents Need Plugins Too. Here's How I Gave Them One.

If you've spent any time building with AI agents lately, you've probably run into this exact wall: your agent is smart, but it doesn't know things it should know. Your Laravel Livewire conventions. Your team's component library. The exact patterns your codebase expects. So you paste the same context into every prompt, over and over, and it still doesn't quite stick.

That annoyance is what pushed me to build Laravel Skills — a small, focused package that lets you install, list, and uninstall "skills" for your AI agents, straight from your Laravel app, the same way you'd manage a Composer dependency.

Wait, What's a "Skill"?

Think of a skill as a portable knowledge package for an agent — a Git repo containing documentation, patterns, and reference material an AI coding assistant can pull in and actually use. Instead of re-explaining your UI library or your API conventions in every session, you package that knowledge once, put it in a repo, and let your agent install it.

A skill is nothing exotic. It's just a Git repository with one required file at its root:

{
    "name": "example-skill",
    "provider": "anthropic"
}

Everything else — docs, guides, reference material, even a service provider — is entirely up to you.

Show, Don't Tell

Here's the whole workflow, end to end:

composer require shadman/laravel-skills

php artisan skill:install https://github.com/shadmanshaikh/mary-ui-skill.git
php artisan skill:list

+---------------+-------+-------------------------------------+
| Name          | Valid | Path                                |
+---------------+-------+-------------------------------------+
| mary-ui-skill | Yes   | /app/.agents/skills/mary-ui-skill   |
+---------------+-------+-------------------------------------+

That's it. The skill is cloned, validated against its manifest, and sitting in .agents/skills/, ready for your agent (or your own tooling) to read.

Uninstalling is just as simple:

php artisan skill:uninstall mary-ui-skill --force

It's Just as Easy to Drive Programmatically

If you want to build your own tooling on top of it — say, an internal dashboard for managing which skills are installed across projects — the SkillManager is a plain singleton you can resolve from the container:

use Shadman\LaravelSkills\Managers\SkillManager;

$manager = app(SkillManager::class);

$skill = $manager->install('https://github.com/user/example-skill.git');
// ['name' => 'example-skill', 'path' => '/app/.agents/skills/example-skill']

foreach ($manager->list() as $skill) {
    $skill['name'];
    $skill['valid'];
    $skill['manifest']; // the whole decoded skill.json — your custom keys included
}

Every extra key you add to skill.json — version, description, triggers, whatever your workflow needs — comes back untouched in list(). The package doesn't opinionate on what a skill contains, only that it exists and is valid.

Built for the "Don't Trust Random URLs" Reality

Because this package's whole job is running git clone on a URL someone hands it, I treated security as a first-class concern, not an afterthought:

Transport is locked down to https:// and git@ only — no ext:: transport, no shell-injection-via-git-protocol tricks, and no arguments starting with - that git might mistake for flags.
Skill names are sanitized to [A-Za-z0-9._-]+, so a malicious repo URL can't path-traverse its way outside your configured skills directory.
Failed installs clean up after themselves. If a clone times out or the manifest is invalid, the half-installed directory is removed before an exception ever reaches you.

It's worth saying plainly: this package clones and validates skills, but it doesn't execute or autoload them for you. There's no signature verification. Treat every skill like any other third-party dependency — only install from sources you trust.

Configuration Stays Out of Your Way

// config/skills.php
return [
    'path' => base_path('.agents/skills'),
    'clone_timeout' => 120,
];

Two options, sensible defaults, publish the config only if you actually need to change something.

Why I Built This

I'm a full-stack developer moving deeper into AI agent tooling, and one pattern kept repeating: agent context is either baked into a giant system prompt (fragile, unmaintainable) or scattered across docs nobody re-reads (useless). Skills-as-git-repos gives you something in between — versioned, installable, shareable knowledge packages that live alongside your code instead of inside a prompt you keep re-pasting.

If you're building agent-powered tooling in Laravel and you're tired of copy-pasting the same context into every session, give it a spin:

👉 github.com/shadmanshaikh/laravel-skills

It's MIT-licensed, PHP 8.2+, works with Laravel 11/12/13, and PRs are welcome. If you build a skill of your own, I'd love to see it.

Found a bug or have an idea for the package? Open an issue on GitHub — or drop a comment below, I'd love to hear what skills you'd want to build first.

DEV Community: shadman Shaikh