Agent Skills › Dolibarr/dolibarr › code-review

code-review

GitHub

审查并修复Dolibarr PHP代码，确保符合PSR-12编码规范、消除尾部空格、翻译注释及扫描安全漏洞。

.agents/skills/code-review/SKILL.md Dolibarr/dolibarr

Trigger Scenarios

用户要求审查或审计代码质量提及安全漏洞或PSR-12合规性请求修复代码风格问题

Install

npx skills add Dolibarr/dolibarr --skill code-review -g -y

More Options

Non-standard path

npx skills add https://github.com/Dolibarr/dolibarr/tree/develop/.agents/skills/code-review -g -y

Use without installing

npx skills use Dolibarr/dolibarr@code-review

指定 Agent (Claude Code)

npx skills add Dolibarr/dolibarr --skill code-review -a claude-code -g -y

安装 repo 全部 skill

npx skills add Dolibarr/dolibarr --all -g -y

预览 repo 内 skill

npx skills add Dolibarr/dolibarr --list

SKILL.md

Frontmatter

{
    "name": "code-review",
    "license": "MIT",
    "description": "Reviews Dolibarr PHP code for compliance with coding standards and security best practices, and fixes identified issues. Use when the user asks to review, audit, fix, or update code for Dolibarr, or mentions code quality, security vulnerabilities, or PSR-12 compliance.\n",
    "allowed-tools": [
        "read_file",
        "write_file",
        "grep"
    ],
    "user-invocable": true
}

Skill: Review Dolibarr Code and Fix Bad Practices

When to Use This Skill

Use this skill whenever the user asks to review, audit, or fix Dolibarr code to match best practices.

Inputs

The user request should contain, when available:

a module name
or a directory name
or a file name

General Rules

follow the coding style already used in files in the module builder template at htdocs/modulebuilder/templates
modify the minimum amount of existing code

Rules

use PSR-12 coding style except for indentation, which must use TAB characters and not spaces
remove all spaces at the end of lines
rewrite all non-English code comments in English
scan files for security vulnerabilities

Output

When generating code:

provide only the relevant PHP code
preserve the existing file formatting
do not rewrite unrelated methods
explain briefly what is being fixed

Examples

Input: "Review the supplier invoice module for security issues"

Action:

scan htdocs/fournisseur/ directory for common vulnerabilities
check for unescaped SQL queries
verify all user inputs use GETPOST() with type parameters
ensure HTML output is escaped with dolPrintHTML() or dolPrintHTMLForAttribute()

Input: "Fix coding style in htdocs/core/lib/functions.lib.php"

Action:

review file against PSR-12 standards (with TAB exception)
remove trailing whitespace
convert non-English comments to English
apply consistent formatting

Error Handling

Common Failures and Validation

Issue	Validation	Solution
File not found	Verify path exists	Check module structure and file location
Syntax errors after fix	Run PHP lint	Roll back and reapply changes carefully
Breaking existing functionality	Run existing tests	Verify tests pass before and after changes
False positives in security scan	Manual verification	Cross-check with Dolibarr security guidelines
Mixed line endings	Check with `cat -A`	Normalize to LF

Before applying fixes:

back up the original file
verify the file is not part of a protected core module
run existing tests to establish a baseline
apply changes incrementally

Gotchas

Dolibarr conventions override PSR-12: Tabs must be used for indentation, not spaces, even though PSR-12 recommends spaces
Legacy code: Some older modules cannot be fully PSR-12 compliant. Prioritize consistency with existing module style
Global variables: Dolibarr uses globals like $db, $conf, $user. Do not remove these without understanding the architecture
Dolibarr functions: Prefer built-in Dolibarr functions (e.g., dol_print_date(), getDolGlobalString()) over native PHP functions
SQL injection: Dolibarr has its own sanitizing and escaping methods ($db->escape(), casting to (int), $db->sanitize()). Do not replace with prepared statements without testing
XSS protection: Use dolPrintHTML(), dolPrintHTMLForAttribute(), or dol_htmlentities() for output, not native htmlentities()
CSRF tokens: All POST forms must include <input type="hidden" name="token" value="'.newToken().'">