Claude Code skills · updated 2026-10-03

Livewire security skill for Claude Code — open methods and writable state

14 findings in one Livewire component, each with file:line and the fix

On the bundled invoice component: 14 findings (11 high, 2 medium, 1 low) from 10 rules, including $wire.deleteInvoice() with no authorization and $apiToken readable in view-source.

Get it on Whop - $12 onceGet it on Gumroad

What it printed on the bundled example

== Livewire Client Surface Audit — 14 findings (0 errors, 0 warnings, 14 info) in 1 file · 10 rules
  HIGH  livewire-sample.php:14  [unlocked_state_property]
        Livewire round-trips every public property through the page, so the browser can send back any value for $invoiceId before the next method runs.
        fix: Add the #[Livewire\Attributes\Locked] attribute above the property, or re-read the value from the database instead of trusting the round-trip.
  HIGH  livewire-sample.php:15  [unlocked_state_property]
        Livewire round-trips every public property through the page, so the browser can send back any value for $amountDue before the next method runs.
        fix: Add the #[Livewire\Attributes\Locked] attribute above the property, or re-read the value from the database instead of trusting the round-trip.
  HIGH  livewire-sample.php:16  [unlocked_state_property]
        Livewire round-trips every public property through the page, so the browser can send back any value for $status before the next method runs.

What you get

• SKILL.md, an offline Node scanner (scripts/scan.js) and the 10-rule table
• file:line, severity and what the browser can call, read or rewrite
• Fix lines (#[Locked], authorize(), validate()), applied only after you agree
• --json output to gate CI on any finding

Install

Unzip into ~/.claude/skills/ (all projects) or your-repo/.claude/skills/ (one repo), then ask Claude Code: "Can a user call any of our Livewire methods or change a property they shouldn't? Don't edit anything yet.". Needs Node 16+.

unzip livewire-security-audit.zip -d ~/.claude/skills/

Ask Claude

“Can a user call any of our Livewire methods or change a property they shouldn't? Don't edit anything yet.”

What it does not do

It does not run your app or see middleware, route policies or parent classes; no network calls, no edits without your OK.

FAQ

What is a Claude Code skill?

A folder with a SKILL.md and scripts that Claude Code loads when your request matches it. You ask in plain words and Claude runs the scanner the skill carries.

How is this different from asking Claude without the skill?

The skill carries a dated rule table and a scanner that reads every file, so Claude quotes the exact date and line instead of answering from memory.

Does it send my code anywhere?

It does not run your app or see middleware, route policies or parent classes; no network calls, no edits without your OK.

How do I install it?

Unzip into ~/.claude/skills/ (all projects) or your-repo/.claude/skills/ (one repo), then ask Claude Code: "Can a user call any of our Livewire methods or change a property they shouldn't? Don't edit anything yet.". Needs Node 16+.

What do I get when I buy?

The zip. On Whop it is in your library as a download lesson with the zip attached; on Gumroad it is the product file.